Aave Hit by KelpDAO Exploit: $200M+ Bad Debt Sparks Rapid Liquidity Crunch
DeFi exploits surged in April, with losses topping $620 million, according to AMBCrypto. Aave, one of the sector's largest lending protocols, was directly impacted by the KelpDAO exploit after attackers minted 116.5K unbacked rsETH and posted it as collateral to borrow higher-quality assets.
The incident left Aave with more than $200 million in bad debt and triggered a swift liquidity shock. Users began pulling funds within hours, driving utilization sharply higher. WETH reserves reached 100% utilization, effectively removing immediate liquidity from the pool and accelerating protocol-wide outflows.
Aave recorded about $16.4 billion in net exits, with deposits falling from $45.6 billion to $29.2 billion (Source: AAVEScan). Total Value Locked slid to $15 billion, a level last seen in November 2024. Stablecoin activity also cooled: stablecoin usage on Aave dropped 54.2%, from $15.95 billion to $7.31 billion, while stablecoins borrowed declined 37.9%, from $10.6 billion to $6.63 billion (Source: AAVEScan).
As funds left Aave, capital rotated toward Sparklend, where TVL rose from $1.9 billion to $3.5 billion, a gain of more than $1.3 billion. The shift suggests larger participants prioritized deeper liquidity and tighter risk controls during the turbulence.
The exploit highlighted Aave's dependence on looping strategies. These trades typically involve depositing ETH-based assets such as rsETH and borrowing Ethereum [ETH] to lever up yields. A Blockworks thread indicated that 98.5% of the collateral backing WETH borrows came from ETH LSTs (Source: Blockworks), concentrating risk rather than spreading it across a more diversified lending book.
When the structure broke, even depositors without direct rsETH exposure were affected because their liquidity supported those leveraged positions. The episode also underscored a structural imbalance: Aave treats lenders uniformly even when underlying risk differs, leaving some depositors bearing higher risk without additional compensation.
Attention has turned to Aave's Umbrella module, designed to absorb bad debt using staked junior capital. Early stress scenarios suggest the backstop may cover only part of a large shortfall, potentially pushing remaining losses onto depositors or the DAO. Elevated utilization and liquidity gaps also weaken liquidation dynamics, slowing the path to recovery and keeping markets cautious.
Aave ultimately absorbed more than $200 million in bad debt after attackers minted 116.5K unbacked rsETH and drained liquidity through leveraged borrowing. As risk appetite faded, investors shifted funds to perceived safer venues such as Sparklend, which drew over $1.3 billion in inflows.
