On April 18, attackers exploited a vulnerability in the verification nodes of the Kelp DAO cross-chain bridge, conjuring approximately $292 million worth of unsecured rsETH, which was immediately deposited into Aave to borrow actual WETH..

This batch of unsecured rsETH was accepted as compliant collateral, but the actual WETH borrowed could not be equivalently covered, exposing Aave to a maximum bad debt exposure of $230.1 million.

According to on-chain analyst Yu Jin's monitoring,as of the morning of April 23,Aave's TVL has dropped below $30 billion, from $45.8 billion before the incident to $29.6 billion, with an outflow amount reaching $16.2 billion, a drop of over 40%.

The spread of panic extends far beyond this. Protocols such as Morpho, Sky, and JupLend, not directly involved with rsETH, also experienced significant outflows, and even protocols on Solana were not spared..

However, this crisis also created an unexpected winner. Some of the funds fleeing Aave flowed directly to Spark, with SPK tokens rising over 150% in the last 7 days.

1. Aave is most severely impacted

Why has Aave become the most pressured party in this incident? It starts with its structure.

As a liquidity re-staking token for Kelp DAO, rsETH's price trend is highly correlated with ETH, categorized by Aave's risk model as low volatility and high liquidity quality collateral.

In E-Mode (Efficiency Mode), it enjoys a loan-to-value ratio (LTV) of up to 93%-95%, allowing users to borrow WETH with extremely high leverage.

This setting essentially prices the strong price correlation between rsETH and ETH, as well as its liquidity performance in the secondary market, but overlooks rsETH's deep dependence on the cross-chain bridging contract (LayerZero V2).

As a result, when attackers exploited a single DVN vulnerability configured in Kelp on April 18 to conjure approximately 116,500 unsecured rsETH (worth about $292 million) and deposited most of it (about 89,567 tokens) into Aave to borrow real WETH, the protocol, while operating as designed, did not trigger abnormal liquidation mechanisms or oracles, directly exposing Aave to hundreds of millions of dollars in bad debt exposure.

Ironically, just nine days before the incident (April 9), the newly appointed risk service provider LlamaRisk submitted a proposal to Risk Stewards, citing "strong market demand, ample on-chain liquidity, and healthy user leverage behavior," to raise the supply limit of rsETH on Ethereum mainnet from 480,000 to 530,000 tokens.

At that time, the utilization rate of rsETH on Aave was already close to 99.9%, and the leveraged re-staking strategies were in full swing, yet no one reviewed the safety assumptions underlying the bridging.

After the attack, Aave quickly suspended WETH withdrawals, leading to a clear discount on the deposit certificate aETHWETH.On-chain tracking shows, due to Aave's suspension of WETH withdrawals, the deposit certificate aETHWETH saw a discount, leading a whale to withdraw 13,000 ETH from the exchange, swap for aETHWETH and repay the loan 1:1, netting 143 ETH.

The contagion effect quickly spread to stablecoin pools. Circle Chief Economist Gordon Liao initiated an urgentgovernance proposal, proposing to raise the maximum deposit interest rate for USDC on Aave V3 Ethereum to approximately 48.2% to address the situation where the utilization rate of the USDC pool exceeded 99.87% for several consecutive days, causing liquidity to nearly freeze.

This storm is still brewing. Aavepreviously proposed two loss handling paths: one is to let all rsETH holders share about 15% of the discount, with the bad debt scale at about $123.7 million; the other is to isolate the losses to L2, preventing impact on Ethereum mainnet, but Mantle will face a 71.45% WETH gap, Arbitrum will face a 26.67% gap, expanding the bad debt scale to about $230.1 million.

On April 21, the Arbitrum Security Council announced an emergency freeze of 30,766 ETH (about $71 million) held by addresses related to the attack and transferred it to a governance-controlled intermediate wallet.

Aave founder Stani Kulechov stated that the team is working with multiple partners to advance various recovery plans to achieve an orderly return to normal market conditions and protect user interests. The Arbitrum Security Council has recovered $70 million worth of ETH, significantly reducing potential risk exposure.

DefiLlama founder 0xngmi further pointed out that if the frozen funds are prioritized for the Arbitrum native Aave market, the bad debts related to rsETH are expected to decrease by 80% or even close to zero under the shared depreciation.

Nevertheless, Aave's Umbrella security reserves (approximately $80 million to $100 million) are still insufficient to cover a potential gap of $230.1 million. The protocol has advised pausing the Umbrella module to prevent automatic slashing from being triggered too quickly, instead opting for manual governance handling.

As of now, the WETH reserves in the Ethereum Core V3 market have been partially unfrozen, but the LTV remains at 0; WETH reserves in chains such as Prime, Arbitrum, Base, Mantle, and Linea remain frozen or limited.

2. Why did Spark avoid this loss?

Spark achieved zero direct losses during this Kelp DAO rsETH bridging attack, a decision that can be traced back to January 2026. When Aave incorporated rsETH into E-Mode and opened high leverage lending within the same timeframe, Spark chose to delist rsETH and other low utilization assets while tightening collateral admission standards.

After the incident, Spark's strategic director monetsupply.eth wrote to explain the rationale at that time, Spark has long set a high maximum interest rate cap for the ETH lending market, actively ceding part of its business and revenue to Aave (which had previously lowered ETH borrowing rates to below 10% to attract leveraged users) over the past year.

This choice had sparked considerable dissatisfaction among ETH leveraged strategy users, leading some funds to flow out of Spark. However, it has proven that delisting rsETH was an exceedingly prudent move—SparkLend's ETH withdrawal liquidity remains robust, while Aave's related markets have become locked in high utilization.

monetsupply.eth also warned免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。