Alvin Lang
Apr 20, 2026 03:54
Aave loses $8 billion in TVL after hackers use stolen Kelp DAO funds as collateral, creating $195M in bad debt and freezing $5.1B in stablecoins.
Aave just lost its crown as DeFi’s largest protocol. A $293 million exploit at Kelp DAO cascaded into an $8 billion TVL collapse at Aave over the weekend, with the AAVE token plunging 20% from $112 to $89.50 in roughly 25 hours.
The damage extends far beyond one protocol. Over $5.1 billion in USDT and USDC sits frozen in Aave v3 lending pools, now at 100% utilization. Depositors can’t withdraw until new liquidity arrives or borrowers repay.
How the Contagion Spread
Saturday’s attack on Kelp DAO’s LayerZero bridge netted hackers 116,500 rsETH tokens. Rather than immediately dumping them, the attackers got creative—they posted the stolen assets as collateral on Aave v3 and borrowed wrapped Ether against them.
This created approximately $195 million in “bad debt” on Aave, according to Lookonchain. The rsETH collateral, now tainted by the exploit, became essentially worthless for recovery purposes.
What followed was predictable: a bank run. DeFiLlama data shows Aave’s TVL cratered from $26.4 billion to $18.6 billion by Sunday. Major players fled first. MEXC pulled $431 million. Abraxas Capital yanked $392 million.
Stablecoin Pools Seized Up
The USDT pool tells the story. Out of $2.87 billion deposited, exactly $2,540 was available for withdrawal at one point. That’s not a typo—two thousand dollars liquid in a nearly three-billion-dollar pool.
Aave responded by freezing rsETH markets on both v3 and v4 versions. WETH reserves got locked down across Ethereum, Arbitrum, Base, Mantle, and Linea. The protocol maintains that rsETH on Ethereum mainnet remains fully backed by underlying assets, though that’s cold comfort for those who can’t access their stablecoins.
DeFi’s Interconnection Problem
The ripple effects keep spreading. Curve Finance, Ethena, and BitGo’s WBTC have all paused LayerZero bridge integrations until the mess gets sorted.
This marks the first real stress test of Aave’s “Umbrella” security model, introduced in June 2025 to automate protection against bad debt. The timing couldn’t be worse—Aave parted ways with risk manager Chaos Labs just two weeks ago over disagreements about v4 direction and budget.
A Bank of Canada study earlier this month praised Aave v3 for avoiding bad debt through overcollateralization and automated liquidations. That analysis aged poorly.
What Happens Next
The immediate question: when do stablecoin pools unlock? That depends entirely on whether new deposits arrive or existing borrowers repay. Neither seems imminent given current sentiment.
Aave v4 just launched at EthCC with a new “hub-and-spoke” architecture for real-world assets. Whether that expansion continues on schedule while the protocol manages this crisis remains unclear. For traders, the AAVE token at $89.50 represents either a buying opportunity or a falling knife—the next few days of TVL data will tell which.
Image source: Shutterstock
