Aave Sees $8.45 Billion Pulled After KelpDAO Bridge Exploit, Core Protocol Holds

Aave recorded $8.45 billion in withdrawals after the KelpDAO rsETH crosschain bridge was compromised in April 2026, even as the protocol's core functions continued to operate. The exploit targeted KelpDAO's LayerZero-based crosschain bridge and led to the theft of $292 million in rsETH. The loss intensified market scrutiny of rsETH's collateral quality and raised fresh questions around its solvency. In response, Aave's risk team triggered emergency measures, including freezing impacted activity and adjusting key risk parameters, to limit potential spillover. Founder Stani Kulechov said the protocol performed as intended under extreme stress. Independent analysts said the episode underscored how DeFi lending can amplify concentration, liquidity and contagion risks given tight interconnections across protocols. Aave manages these exposures through loan-to-value (LTV) limits, liquidation thresholds, supply and borrowing caps, Isolation Mode, EMode and governance controls.