Overview
- Attackers exploited KelpDAO’s rsETH bridge on April 18, then posted the unbacked tokens on Aave V3 to borrow about $196 million in wrapped ether.
- Users withdrew about $15.1 billion over roughly three and a half days, which cut total value locked from $48.5 billion to about $30.7 billion.
- Major lending pools reached 100% utilization, which left no liquidity for withdrawals or liquidations and trapped about $3 billion in USDT and $2 billion in USDC.
- Aave governance froze rsETH markets, set loan-to-value to zero, and adjusted interest rates as LlamaRisk modeled potential bad debt between $123.7 million and $230.1 million.
- The protocol’s code was not breached, but the AAVE token fell into the low $90s as confidence wavered.