Aave Still Down $8 Billion After Kelp DAO Hack

The Aave lending protocol has seen significant losses since the Kelp DAO cross-chain bridge exploit in April. At its peak, deposits on Aave stood at $26.1 billion, but after the hack, they dropped to approximately $18.1 billion, a decline of about 31%. The lenders' own code was not compromised, but the collateral behind its loans failed due to the attack.

The Kelp DAO exploit targeted how the cross-chain bridge checked incoming messages, not its lending logic. Attackers released 116,500 rsETH worth around $292 million, close to 18% of the token's supply, with no backing. This unbacked token then walked into lending markets, where it was supplied on Aave and borrowed roughly $193 million against it.

Aave froze the rsETH across 11 markets within an hour and two days later froze WETH. The bad debt from this event was estimated at $123.7 million if losses were spread evenly, but isolating the bridged rsETH pushed it to $230.1 million. Rival protocols covered the hole, with a coalition-funded recovery plan gathering about 69,570 ETH in pledges against a 75,081 ETH shortfall.

Despite this, depositors have been slow to forgive, with Aave holding $12.5 billion at the end of June and $18.1 billion this week. The same structure is seen elsewhere, where receipt tokens place something between a borrower and the asset, raising questions about how many independent parties must sign off on the token's bridge.