Five Months After the Kelp Hack, Aave Is Still Down $8 Billion

Deposits on Aave stood at $18.1 billion as of this writing, which is approximately 31% below the $26.1 billion it held the day before April's Kelp hack, according to DefiLlama.

The lender's own code never failed. What failed was the collateral behind its loans, in a place those loan contracts could not check.

What the Kelp Hack Actually Broke

On April 18, attackers went after how Kelp DAO's cross-chain bridge checked incoming messages, not its lending logic. Kelp is a liquid restaking protocol, and rsETH is its receipt token.

An rsETH holder does not hold ether. They hold a claim on staked ether, and that claim crossed a bridge first. They corrupted the data feeds that bridge trusted and pushed a fake message through it. That released 116,500 rsETH worth about $292 million, close to 18% of the token's supply, with nothing behind it.

Security firm Halborn traced the theft to a single-verifier setup and hijacked data nodes. Chainalysis linked the attackers to North Korea's Lazarus Group. No contract was broken.

The unbacked tokens then walked into lending markets. Attackers supplied 89,567 rsETH on Aave and borrowed roughly $193 million against it.

Aave froze rsETH across 11 markets within the hour and froze WETH two days later. BeInCrypto warned Aave WETH suppliers to pull out that same evening, hours before those pools hit full utilization.