Curve founder Michael Egorov said the KelpDAO exploit caused roughly $292 million in losses and left Aave with bad debt, underscoring vulnerabilities in today's "non-isolated lending" model. In a post dated April 19 (UTC+8), Egorov noted that while the approach scales well, it concentrates risk and demands stronger risk controls. He added that fully isolated and hybrid designs could be practical alternatives, and pointed to Aave v4's proposed "hub-and-spoke" architecture as a potential path toward more secure lending structures. (Source: ODAILY)

Andre Cronje, co-founder of Sonic Labs and founder of Flying Tulip, said on April 19 that his team is still investigating the L0/rsETH incident. Early findings indicate around $200 million in rsETH may have been stolen, likely stemming from a compromised private key or a configuration error. Cronje said the stolen rsETH was later deposited into Aave to borrow ETH, citing insufficient rsETH liquidity. He noted the position was technically collateralized, and added that even in a scenario where collateral proved inadequate, Aave's token and safety module are designed to act as the first layer of protection against bad debt. He also cautioned that Aave has no mechanism to reimburse user losses, meaning an extreme outcome could spark a bank-run style withdrawal wave. Even so, he assessed the risk as contained given Aave's roughly $7 billion in ETH, versus about $100 million in withdrawals and PUT's $17 million in exposure. Cronje emphasized that the priority is maintaining PUT user liquidity. He said the team has withdrawn all ETH from Aave into its own wrapped contract after Aave's available liquidity fell below their minimum threshold.

April 19 — Curve founder Michael Egorov said he hopes Aave can address fallout from the recent Kelp DAO exploit, which he claimed resulted in roughly $292 million in losses and left Aave with bad debt. Egorov argued the incident highlights a core vulnerability of the widely used "non-isolated lending" model: it scales well, but concentrates risk, making rigorous risk management essential—an area where he noted Aave has historically performed strongly. He outlined potential alternatives, including a fully isolated design like Curve Finance's market, or a hybrid approach that is more complex to implement but workable. Egorov added that the market has yet to fully appreciate the benefits of these structures, and suggested Aave v4's hub-and-spoke architecture could be a move toward a semi-isolated, more secure framework.

April 19 — Andre Cronje, co-founder of Sonic Labs and founder of Flying Tulip, said his team is continuing to investigate the L0/rsETH incident. Early findings indicate a compromised private key or a configuration mistake may have enabled the theft of roughly $200 million worth of rsETH. Cronje said the rsETH was then deposited into Aave to borrow ETH, citing limited rsETH liquidity. He noted the position remains collateralized from a technical standpoint, and added that even in an under-collateralized scenario, Aave's token and security module are designed to serve as a first line of defense against bad debt. He also stressed that Aave has no mechanism to reimburse user losses, meaning that in an extreme scenario the situation could trigger a "bank run." Still, he said the potential fallout appears contained given Aave's roughly $7 billion in ETH versus about $100 million in withdrawals and PUT's $17 million exposure. Cronje said the priority remains protecting users' PUT liquidity. As Aave's available liquidity dropped below the team's minimum threshold, they withdrew all ETH from Aave and moved it into their own wrapped contract.

Lido said on X that it is closely tracking developments related to a security incident at Kelp DAO. As earnETH has exposure to rsETH, the protocol has temporarily suspended new earnETH deposits as a precaution and is working with relevant partners to assess potential impacts. Lido said it will provide additional updates as more information becomes available. The team emphasized that stETH and wstETH are not affected, and the issue is not related to Lido's core staking protocol.

ME News reported that on April 19 (UTC+8), as ceasefire talks between the U.S. and Iran continued, an unusually large, unexplained order resurfaced in the oil market—an event traders often associate with pivotal moments. Data compiled by research firm The Kobeissi Letter showed that at 8:24 a.m. ET on Friday, trading activity abruptly spiked without any headline catalyst: nearly $800 million in transactions went through in a short window, alongside a sharp drop in prices. Twenty-one minutes later, Iran's Foreign Minister Alireza Araghchi said the Strait of Hormuz was "fully open" to all commercial vessels. At 9:06 a.m., U.S. President Trump posted a message thanking Iran for reopening the strait. By 9:10 a.m., U.S. WTI crude futures briefly slipped below $80 a barrel. The Kobeissi Letter estimated the trade generated about $70 million in profit in less than an hour. (Source: PANews)

Caixin reported that at 8:24 a.m. ET on Friday, crude oil trading volume abruptly spiked with no immediate headline catalyst. Nearly $800 million changed hands within a short span, triggering a sharp drop in prices. Twenty-one minutes later, Iran's Foreign Minister Alireza Araghchi said the Strait of Hormuz was "fully open" to all commercial vessels. U.S. President Donald Trump followed with a post at 9:06 a.m. ET, thanking Iran for reopening the passage. By 9:10 a.m. ET, U.S. WTI crude futures briefly slipped below $80 a barrel.

April 19 — Ryan Sean Adams, co-founder of Bankless, said the pace of cryptocurrency hacks has hit an all-time high, arguing the trend is being amplified by artificial intelligence. He wrote that AI is giving hackers "dark superpowers" and warned that defenses need to catch up quickly, adding, "we are out of time." The comments follow a reported attack on Kelp DAO that led to roughly $292 million in losses. Kelp DAO said it detected suspicious cross-chain activity involving rsETH and has paused rsETH contracts on mainnet and multiple L2 networks. The team said it is working with LayerZero, Unichain, and security experts to conduct a root-cause analysis.

Onchain data from analytics firm Lookonchain (@lookonchain) shows that in the aftermath of the KelpDAO incident, the attacker deposited rsETH into Aave and borrowed ETH, leaving Aave with a bad-debt position. The development has prompted several large holders to quickly withdraw ETH from the protocol. Aave's ETH utilization rate is now at 100%.