Kelp DAO bridge exploit turns rsETH into Aave collateral,

A LayerZero-powered bridge exploit at Kelp DAO minted roughly $292 million of unbacked rsETH and routed it into Aave as collateral, enabling an estimated $190–230 million borrow of real assets. The knock-on effect was a 48-hour liquidity squeeze that pinned key Aave pools at 100% utilization and repriced stablecoin yields across DeFi.

Key Takeaways

Roughly 116,500 unbacked rsETH (about 18% of supply, valued near $292 million) was minted via a Kelp DAO cross-chain bridge exploit on April 18 and then used as Aave collateral.
The attacker borrowed an estimated $190–230 million of real assets against collateral that proved non-existent when it mattered.
Aave absorbed a liquidity shock rather than a contract failure: $6–10 billion in net outflows hit within 48 hours and WETH, USDT, and USDC pools reached 100% utilization, blocking withdrawals.
Stablecoin yields repriced in days as liquidity disappeared, with Aave deposit APYs reaching 13.4% and Morpho’s USDC vault jumping from 4.4% APR to 10.81% as DeFi TVL fell by more than $13 billion.

Exploit Path: Unbacked rsETH Minted, Then Posted to Aave

The sequence matters because it connects a bridge-layer failure directly to lending-market liquidity.

On April 18, an attacker exploited Kelp DAO’s LayerZero-powered cross-chain bridge to mint roughly 116,500 unbacked rsETH tokens. That amount was described as about 18% of rsETH’s circulating supply and valued around $292 million at the time. The attacker then moved the synthetic rsETH into Aave and posted it as collateral.

From there, the exploit stopped being a “bridge story” and became a balance sheet event inside a lending protocol. Using the unbacked rsETH as collateral, the attacker borrowed an estimated $190–230 million of real assets. The estimate range is important. It signals the figure was still being triangulated rather than finalized.

What stands out here is the asymmetry. The attacker’s collateral was effectively created out of thin air, but the borrowed assets were not. Once those real assets left the protocol, the system’s risk shifted from price volatility and liquidation mechanics to raw liquidity availability.

Aave’s own incident report framed the outcome bluntly: the protocol “functioned as designed,” and the shortfall was “structural, not technical.” That is the core takeaway for traders. The system did not halt. It accepted collateral that later failed the only test that matters in a crisis, which is whether it can be realized when everyone wants out.

Kelp and LayerZero have publicly blamed one another for a “1/1 validator configuration” that made the exploit trivial. The packet does not include the detailed statements or a definitive assignment of responsibility, but the dispute itself is a signal that the weakest link was not a complex on-chain liquidation edge case. It was a single-point security assumption.

Aave’s Liquidity Shock: $6–10B Outflows and 100% Utilization

Within 48 hours of the incident window, Aave saw an estimated $6–10 billion in net outflows. That range again implies measurement uncertainty, but the direction is unambiguous: capital moved fast.

The mechanical expression of that stress was utilization. Utilization is the share of a lending pool’s deposits that has been borrowed. At 100% utilization, there is no idle liquidity left in the pool. Depositors cannot withdraw because the assets are already lent out. Borrowers also struggle to source liquidity because the pool has effectively been drained.

In this episode, utilization on Aave’s WETH, USDT, and USDC pools hit 100%. Depositors couldn’t withdraw. Borrowers couldn’t source stablecoin liquidity. That is a liquidity event, not a smart contract failure.

The second-order effect was behavior that looks irrational until you price the constraint correctly. During the crunch, users borrowed another roughly $300 million against their own locked stablecoin deposits at 75% loan-to-value (LTV) to access cash, often at a loss. That is self-financing under duress. When withdrawals are blocked by utilization, the only way to get liquidity is to borrow it, even if you are effectively borrowing against yourself.

The pattern worth noting is how quickly composability turns localized damage into system-wide stress. DeFi is interoperable by design, and “looping” or recursive leverage amplifies it. The packet states roughly 20% of Aave’s historical borrow volume has come from recursive leverage. When Aave’s pools pin at 100% utilization, the shock transmits to any strategy or protocol that depends on Aave liquidity as a base layer.

Rates Reprice Across DeFi: Aave to Morpho in Two Days

Before the weekend, stablecoin lending on Aave was priced like a low-risk cash product. Before Friday, April 17, lending stablecoins into Aave paid 2.32% APY while the Federal Reserve’s overnight rate was 3.64%. Taken at face value, that meant on-chain lending was yielding below a U.S. “risk-free” benchmark.

Then the exploit hit, and the market repriced the only thing it can reprice instantly: the cost of liquidity.

Aave stablecoin deposit APYs moved from roughly 3–6% pre-exploit to 13.4% within two days. That is not a gradual adjustment. It is a jump consistent with a pool-level shortage where borrowers are forced to pay up to access scarce stablecoins.

The repricing did not stay contained to Aave. Morpho’s USDC vault rose from 4.4% APR on April 18 to 10.81% the next day. APR is a simple annual rate without compounding assumptions, while APY includes compounding assumptions. The key point is direction and speed: both repriced higher immediately as liquidity demand surged.

At the same time, total DeFi TVL across the top 20 chains fell by more than $13 billion. TVL is an estimate of assets deposited in DeFi protocols, and a drawdown of that size over the same episode window is consistent with broad deleveraging and risk-off positioning, not just a single-protocol rotation.

This is where the earlier debate becomes less academic. One view argued DeFi stablecoin rates should trade at a 250–400 basis-point premium over the risk-free rate, implying 6.15–7.76%. Another view pointed to Aave’s 0.00% non-performing loan rate as evidence of “defaultless lending” via strict collateral enforcement. The last 48 hours did not disprove collateral enforcement. It exposed that collateral enforcement is irrelevant if the collateral itself can be minted unbacked and still be accepted.

Signals Traders Can Track After the Bridge-to-Lending Contagion

The next phase is about normalization, or the lack of it.

First, watch utilization on Aave’s WETH, USDT, and USDC pools. If utilization remains pinned near 100%, withdrawal constraints and liquidity premia can persist even without new bad news. If utilization normalizes, it signals liquidity has returned and the immediate squeeze is easing.

Second, track stablecoin deposit rates on Aave and Morpho. Aave’s move to the 13% area and Morpho’s jump to 10.81% happened in days. The question now is whether those rates mean-revert toward the pre-exploit 3–6% range on Aave, or whether the market keeps pricing a higher liquidity and collateral-risk premium.

Third, monitor net flows and TVL trends. The episode coincided with a more than $13 billion drawdown in DeFi TVL across the top 20 chains. Stabilization would suggest the deleveraging impulse is fading. Extension would imply the shock is still propagating through leveraged structures.

Finally, the bridge-layer postmortem matters. Kelp and LayerZero blamed each other for the “1/1 validator configuration.” Any follow-on disclosures that clarify remediation steps or responsibility will shape how quickly markets are willing to treat similar bridged or synthetic collateral as money-good.

The 48-Hour Stress Test for DeFi Credit and Liquidity

I read this episode as a clean demonstration of how bridge risk becomes lending risk the moment a synthetic asset is accepted as collateral. The attacker didn’t need to break Aave. They only needed Aave to do what it is designed to do, which is accept collateral and lend against it. Once roughly 116,500 unbacked rsETH could be minted and posted, the estimated $190–230 million borrow of real assets was the transmission mechanism.

The market impact then expressed itself through liquidity mechanics. The $6–10 billion net outflow range and the 100% utilization prints on WETH, USDT, and USDC are the tells. When utilization hits 100%, the protocol can be “working” and still be unusable for depositors who need to exit. That’s why the $300 million in borrowing against locked deposits at 75% LTV matters. It’s not a quirky footnote. It’s what users do when the only exit is to pay up for liquidity.

From here I’m thinking in scenarios, all tied to observable signals.

Scenario one is normalization. Utilization backs off from 100%, net outflows slow, and stablecoin deposit rates on Aave and Morpho drift down from the 13% and 10.81% prints toward the prior 3–6% band on Aave. That would validate the idea that this was a violent but contained liquidity squeeze, with the market demanding a temporary premium for scarce stablecoins.

Scenario two is persistent repricing. Utilization stays elevated, rates remain sticky in double digits, and TVL continues to trend lower beyond the reported $13 billion drawdown. That would indicate the market is not just paying for liquidity. It is paying for uncertainty around collateral acceptability and composability exposure, especially given the explicit “1/1 validator configuration” failure mode and the unresolved blame dispute.

Scenario three is a structural risk premium reset even if utilization normalizes. Rates could settle above the pre-exploit 2.32% APY context because the episode challenged the premise that overcollateralization alone makes lending “defaultless.” Aave’s 0.00% non-performing loan rate can coexist with a liquidity shortfall if the system accepts collateral that can be manufactured. The confirmation point here is simple. If utilization normalizes but deposit rates do not mean-revert, the market is pricing a higher baseline premium for on-chain credit and liquidity risk.

The decisive signal that confirms the core thesis is sustained higher stablecoin yields that track elevated utilization and slower TVL recovery, showing the market is now pricing bridge-to-lending contagion as a real, recurring liquidity risk.

Sources

CoinDesk