Kelp DAO Bridge Exploit Strains Aave; $6.2B Withdrawn

On Saturday attackers exploited Kelp DAO’s LayerZero-powered bridge to release 116,500 rsETH, roughly $291 million at the time. They used the tokens as collateral on Aave to borrow other assets, which pushed a core lending pool to 100% utilization and led to about $6.2 billion in net withdrawals by early Sunday, according to a DefiLlama co-founder.

Blockchain security firm PeckShield flagged a transaction that moved the rsETH to a newly created wallet hours before the crisis. Kelp DAO paused rsETH contracts on Ethereum mainnet and several layer-2 networks and posted that it is working with LayerZero, Unichain, auditors and security experts on an investigation.

Researcher Stacy Muur wrote that attackers exploited a single point of failure by sending a phantom message that caused the bridge to release rsETH on Ethereum without removing matching tokens from supply on Unichain, allowing the attackers to use the released rsETH for large borrows on Aave.

Aave froze markets tied to rsETH after liquidity in a core pool was drained. The pool’s 100% utilization left lenders with little available liquidity to withdraw. Some users began borrowing stablecoins against their deposits, which tightened liquidity further and pushed lending rates on affected pools to roughly 10–15%.

The incident moved markets. Aave’s governance token fell about 16% to near $90, and ether declined roughly 2% to around $2,300. On-chain analysts noted that multiple other pools were approaching full utilization, increasing the risk of additional bad debt for the protocol.

Kelp DAO and Aave teams continue to track fund flows and assess outstanding positions to identify potential recovery options. Crypto entrepreneur Justin Sun posted a message on X urging the attackers to return funds and avoid wrecking both protocols.

Investigations are ongoing to determine the exact mechanics of the bridge failure, identify the actors involved and assess whether any of the drained assets can be recovered.