Aave's TVL Stuck in the Doldrums Four Months After Record Hack

Aave's total value locked (TVL) has not fully recovered from the devastating $292 million KelpDAO exploit on April 18, 2026. The hack was orchestrated by North Korea's Lazarus Group through a vulnerability in KelpDAO's LayerZero bridge integration.

The attackers exploited a configuration deviation from LayerZero's recommended 2-of-2 standard, minting 116,500 unbacked rsETH tokens without corresponding token burns or locks on the source chain. Approximately $221 million worth of these tokens was then deposited into Aave V3 markets as collateral.

Aave's TVL stood at $26.4 billion immediately prior to the attack and has since declined by 43% to $14.9 billion, representing a $11.5 billion reduction in available lending liquidity.