Five Months After the Kelp Hack, Aave Is Still Down $8 Billion

Deposits on Aave stood at $18.1 billion as of this writing, which is approximately 31% below the $26.1 billion it held the day before Aprils Kelp hack, according to DefiLlama. The lenders own code never failed. What failed was the collateral behind its loans, in a place those loan contracts could not check. Deposits on Aave (TVL). Source: DefiLlama What the Kelp Hack Actually Broke On April 18, attackers went after how Kelp DAOs cross-chain bridge checked incoming messages, not its lending logic. Kelp is a liquid restaking protocol, and rsETH is its receipt token. They corrupted the data feeds that bridge trusted and pushed a fake message through it. That released 116,500 rsETH worth about $292 million, close to 18% of the tokens supply, with nothing behind it. Security firm Halborn traced the theft to a single-verifier setup and hijacked data nodes. Chainalysis linked the attackers to North Koreas Lazarus Group. No contract was broken. The unbacked tokens then walked into lending markets. Attackers supplied 89,567 rsETH on Aave and borrowed roughly $193 million against it. Aave froze rsETH across 11 markets within the hour and froze WETH two days later. BeInCrypto warned Aave WETH suppliers to pull out that same evening, hours before those pools hit full utilization. Aaves smart contracts were not compromised at any point during this event. All protocol logic, including supply, repayment, and liquidation mechanisms, continued to function as designed. Aaves incident report put the bad debt at $123.7 million if losses were spread evenly. Isolating the bridged rsETH pushed it to $230.1 million. What Borrowers Are Trusting Rival protocols covered the hole. A coalition-funded recovery plan gathered about 69,570 ETH in pledges against a 75,081 ETH shortfall. Arbitrums Security Council froze 30,765 ETH of the proceeds, and its DAO released that sum to Aave in June. A US court order sought by creditors holding judgments against North Korea still hangs over the money. Depositors have been slower to forgive than the balance sheet. Aave held $12.5 billion at the end of June and $18.1 billion this week. AAVE trades near $124, down 3.8% on the day. AAVE Price Performance. Source: BeInCrypto The same structure sits elsewhere. Wrapped Bitcoin and other receipt tokens all place something between a borrower and the asset. Three things are worth checking before posting any of them as collateral. How many independent parties must sign off on the tokens bridge Whether the lending market is isolated or shares losses with its neighbors Whether the collateral is a claim on another claim April answered none of those questions for borrowers who lost access. It showed the cost of not asking. Read the article at BeInCrypto