Llamarisk: Kelp rsETH Bridge Exploit Leaves Aave V3 Facing Up to $230M in Potential Bad Debt
A risk post from Llamarisk on the Aave governance forum details how a bridge exploit on KelpDAO's LayerZero V2 rsETH route on April 18, 2026 enabled an attacker to mint 116,500 rsETH via Ethereum's OFT adapter without burning tokens on the source chain, creating potential bad-debt exposure for Aave V3.
Llamarisk said the incident could translate into $123.7 million to $230.1 million in bad debt across seven impacted Aave markets, depending on how Kelp ultimately allocates losses. The report added that Aave's own smart contracts were not compromised and protocol mechanics continued to operate normally.
Attack timeline and on-chain flow
Llamarisk and Aave service-provider coauthors wrote that the exploit occurred at 17:35 UTC in Ethereum block 24,908,285. The Unichain-to-Ethereum route had been configured as a "1-of-1 DVN" path, allowing a single verifier to attest an inbound packet without any corresponding outbound action. The attacker reportedly forged a packet that was verified, committed, and delivered on Ethereum, releasing 116,500 rsETH from the adapter.
The adapter balance dropped from 116,723 rsETH to 223 rsETH in a single block. The stolen rsETH was then spread from one intake wallet across seven addresses. Of the 116,500 rsETH received, 89,567 rsETH was deposited into Aave V3 on Ethereum and Arbitrum as collateral, used to borrow roughly 82,650 WETH and 821 wstETH. Health factors on the positions clustered between 1.01 and 1.03, and all seven addresses remained active on Aave at the time of publication.
Protocol response measures
The Protocol Guardian began freezing rsETH and wrsETH reserves across all Aave V3 deployments around 19:00 UTC on April 18, setting LTV to zero and disabling new supply and borrowing while leaving repayment and liquidation available for existing positions. The Aave forum analysis said 11 markets were affected across Ethereum, Arbitrum, Avalanche, Base, Ink, Linea, Mantle, MegaETH, Plasma, and Zksync.
Llamarisk reported that the Risk Steward adjusted WETH interest-rate models on Arbitrum, Base, Mantle, and Linea at about 14:30 UTC on April 19, reducing Slope 2 to 1.50% and lowering the borrow rate at 100% utilization from roughly 8.5%–10.5% to 3.0% APR. A similar change was applied to Core around 05:00 UTC on April 20, setting Slope 1 at 2%, Slope 2 at 3%, and optimal utilization at 94%.
The Protocol Guardian also froze WETH on Core, Prime, Arbitrum, Base, Mantle, and Linea around 02:00 UTC on April 20 to curb new borrowing and limit spillover risk into stablecoin reserves.
Two loss-allocation scenarios
Llamarisk modeled two outcomes based on how Kelp "socializes" losses from 112,204 unbacked rsETH:
Scenario 1: If losses are distributed uniformly across the entire rsETH supply, Llamarisk estimates a 15.12% depeg and about $123.7 million in bad debt. Ethereum Core would absorb $91.8 million in absolute terms, and Mantle would face a 9.54% WETH reserve shortfall.
Scenario 2: If losses are isolated to L2 rsETH, the model applies a 73.54% haircut to collateral on remote chains while keeping Ethereum mainnet rsETH intact. Llamarisk estimates about $230.1 million in bad debt, concentrated on Mantle with a 71.45% WETH shortfall and Arbitrum with 26.67%.
Backing status, liquidity stress, and treasury capacity
The report said the adapter balance currently stands at 40,373 rsETH, described as the only confirmed backing for all remote-chain rsETH across every L2 path, versus total remote claims of 152,577 rsETH. Kelp has not publicly confirmed how any recovered funds will be allocated.
As of April 20, 2026, Llamarisk reported the Aave DAO treasury holds $181 million in assets, including $62 million in Ethereum-correlated holdings, $54 million in AAVE, and $52 million in stablecoins. The DAO generated $145 million in revenue during 2025 and $38 million year-to-date in 2026. Llamarisk also said several indicative recovery commitments from ecosystem participants are already being secured to address potential bad-debt scenarios.
The report flagged stressed liquidity conditions in WETH reserves on Ethereum, Arbitrum, Base, Linea, and Mantle, all at 100% utilization with idle balances below $20 on each chain. At full utilization, liquidators receive aWETH rather than underlying WETH, slowing liquidation throughput. Llamarisk identified Base and Arbitrum as the least buffered markets, with first liquidations triggered by WETH price declines of 0.77% and 1.77%, respectively, given health factors near 1.03.
Llamarisk recommended an immediate pause of the WETH Umbrella staking module under Scenario 1. At the time of publication, 18,922 of 23,507 staked aWETH had entered the unstaking cooldown. A pause would block deposits, withdrawals, transfers, and slashing while keeping rewards distribution active.
Llamarisk added that the remaining four rsETH-listed markets—Ethereum Lido, MegaETH, Plasma, and Zksync—carry minimal balances with no bad debt, and that 12 additional Aave V3 markets do not list rsETH and are unaffected.
