$293M Kelp DAO Hack Exposes Weaknesses in Aave's Security Model
A massive $293 million hack on Kelp DAO exploited a vulnerability in Aave's security model, resulting in nearly $8 billion wiped from the platform's total value locked (TVL).
The attack began Saturday when attackers drained 116,500 Kelp DAO Restaked ETH tokens, worth approximately $293 million, from a LayerZero-powered bridge. The stolen rsETH tokens were then deposited as collateral on Aave v3 to borrow wrapped ETH.
Aave's TVL fell from roughly $26.4 billion to $18.6 billion by Sunday, stripping the protocol of its position as the largest DeFi platform by deposited assets. The $AAVE token also took a hit, dropping nearly 20% in 25 hours from $112 on Saturday at 6:00 p.m. UTC to $89.5 by Sunday evening.
Aave confirmed it froze rsETH markets on both v3 and v4 to halt further suspicious borrowing activity, but not before the protocol absorbed approximately $195 million in bad debt. The incident has sparked concerns about the interconnectedness of DeFi infrastructure and the need for stronger security measures.