Aave’s risk management provider has outlined two possible outcomes for how bad debt from the Kelp DAO exploit could affect the protocol, depending on how losses are allocated.
The exploit began Saturday when attackers stole 116,500 Kelp DAO Restaked ETH (rsETH) tokens — roughly $293 million — from a LayerZero-powered bridge and used them as collateral on Aave V3 to borrow wrapped Ether (wETH). Since the attack, nearly $10 billion in value has left Aave, underscoring contagion risk in interconnected DeFi systems.
LlamaRisk modeled two scenarios for how the resulting bad debt might materialize, while noting the final decision rests with Kelp DAO.
Scenario 1: Losses spread across all rsETH holders
– Losses would be distributed across rsETH holders on Ethereum mainnet and layer 2s.
– Estimated bad debt on Aave: about $123.7 million.
– Risk of rsETH depegging roughly 15% versus ETH.
– In absolute terms, wETH would absorb the largest portion of the loss but likely handle it relative to its reserve depth.
– Aave could use its Umbrella security model to cover shortfalls in wETH. Currently, 18,922 Aave Wrapped ETH (aWETH) tokens (about $43.7 million) are in the unstaking cooldown phase.
Scenario 2: Losses concentrated on Ethereum layer 2s
– The entire shortfall would fall to L2 networks such as Arbitrum and Mantle.
– Estimated bad debt on Aave: about $230.1 million — materially higher than scenario 1.
Aave also has roughly $181 million in its treasury that could be deployed to address a shortfall.
Kelp DAO has said it is assessing the financial impact and working with Aave, LayerZero and other stakeholders on how to safely unpause the protocol. Kelp reported that two nodes tied to the LayerZero bridge were compromised and a third was hit with a distributed denial-of-service attack. The attacker forged a transfer message that the system accepted, enabling the minting of 116,500 rsETH on one of LayerZero’s bridges.
Kelp paused all affected contracts on Ethereum and layer 2s and blacklisted wallets linked to the exploiter, preventing the theft of an additional ~40,000 rsETH (about $95 million). The DAO continues to evaluate options for remediation and coordination with partners.
