Alvin Lang
Apr 20, 2026 03:54
Aave loses $8 billion in TVL after hackers use stolen Kelp DAO funds as collateral, creating $195M in unhealthy debt and freezing $5.1B in stablecoins.
Aave simply misplaced its crown as DeFi’s largest protocol. A $293 million exploit at Kelp DAO cascaded into an $8 billion TVL collapse at Aave over the weekend, with the AAVE token plunging 20% from $112 to $89.50 in roughly 25 hours.
The harm extends far past one protocol. Over $5.1 billion in USDT and USDC sits frozen in Aave v3 lending swimming pools, now at 100% utilization. Depositors cannot withdraw till new liquidity arrives or debtors repay.
How the Contagion Unfold
Saturday’s assault on Kelp DAO’s LayerZero bridge netted hackers 116,500 rsETH tokens. Moderately than instantly dumping them, the attackers bought inventive—they posted the stolen belongings as collateral on Aave v3 and borrowed wrapped Ether towards them.
This created roughly $195 million in “unhealthy debt” on Aave, based on Lookonchain. The rsETH collateral, now tainted by the exploit, grew to become primarily nugatory for restoration functions.
What adopted was predictable: a financial institution run. DeFiLlama knowledge exhibits Aave’s TVL cratered from $26.4 billion to $18.6 billion by Sunday. Main gamers fled first. MEXC pulled $431 million. Abraxas Capital yanked $392 million.
Stablecoin Swimming pools Seized Up
The USDT pool tells the story. Out of $2.87 billion deposited, precisely $2,540 was accessible for withdrawal at one level. That is not a typo—two thousand {dollars} liquid in a virtually three-billion-dollar pool.
Aave responded by freezing rsETH markets on each v3 and v4 variations. WETH reserves bought locked down throughout Ethereum, Arbitrum, Base, Mantle, and Linea. The protocol maintains that rsETH on Ethereum mainnet stays totally backed by underlying belongings, although that is chilly consolation for individuals who cannot entry their stablecoins.
DeFi’s Interconnection Drawback
The ripple results maintain spreading. Curve Finance, Ethena, and BitGo’s WBTC have all paused LayerZero bridge integrations till the mess will get sorted.
This marks the primary actual stress check of Aave’s “Umbrella” safety mannequin, launched in June 2025 to automate safety towards unhealthy debt. The timing could not be worse—Aave parted methods with threat supervisor Chaos Labs simply two weeks in the past over disagreements about v4 path and finances.
A Financial institution of Canada examine earlier this month praised Aave v3 for avoiding unhealthy debt by means of overcollateralization and automatic liquidations. That evaluation aged poorly.
What Occurs Subsequent
The fast query: when do stablecoin swimming pools unlock? That relies upon completely on whether or not new deposits arrive or current debtors repay. Neither appears imminent given present sentiment.
Aave v4 simply launched at EthCC with a brand new “hub-and-spoke” structure for real-world belongings. Whether or not that enlargement continues on schedule whereas the protocol manages this disaster stays unclear. For merchants, the AAVE token at $89.50 represents both a shopping for alternative or a falling knife—the following few days of TVL knowledge will inform which.
Picture supply: Shutterstock