Ryan Sean Adams, co-founder of Bankless, said the crypto sector is seeing cyberattacks at an all-time high, arguing that AI is giving hackers stronger tools and urging the industry to step up defensive measures. Kelp DAO, which previously lost about $292 million in an attack, has halted its rsETH contracts across mainnet and several L2 networks. The team said it is working with LayerZero, Unichain and security specialists to determine the root cause.

Mei News reported that on April 19 (UTC+8), Ember Monitoring data showed a rush of risk-driven outflows from Aave after hackers illicitly minted rsETH through the protocol and borrowed large amounts of Ethereum. Total emergency withdrawals from Aave have exceeded $5.4 billion. Sun Zhengchen withdrew 65,584 ETH from Aave, worth about $154 million. Onchain borrowing demand has since rotated toward protocols such as Spark, briefly pushing Spark's ETH deposit rate to 130% before easing to around 18%, according to the monitoring data. (Source: Foresight News)

BlockBeats reported that on April 19 Aave's Guardian froze the rsETH and wrsETH markets across all deployments after receiving an alert about a potential rsETH vulnerability. Aave said its liquidity pools remain secure and fully operational, and stressed the issue relates to the rsETH asset itself rather than any flaw in the Aave protocol. The underlying cause is being investigated by KelpDAO, LayerZero and other teams, with Aave working alongside them. On Aave V3, the Guardian's action blocks new deposits and prevents users from initiating new borrows with rsETH as collateral, while existing positions are unchanged. On Aave V4, the Protocol Safety Committee applied equivalent safeguards by disabling new rsETH-related deposits and borrowing. The associated configuration changes were carried out via Aave Core Hub and Kelp E Spoke.

On-chain analyst Ember (@EmberCN) reported that a hacker borrowed a large amount of ETH on Aave after illicitly minting rsETH and using it as collateral. In response, users have withdrawn more than $5.4 billion from Aave as a risk precaution. Sun Guangchuan alone pulled 65,584 ETH, worth about $154 million. Lending demand on-chain has since shifted toward protocols such as Spark, where the ETH deposit rate briefly spiked to 130% and is now around 18%.

Liquid restaking protocol @KelpDAO was exploited today for 116,500 rsETH worth about $292 million. The attacker quickly routed the stolen tokens through @aave, Compound V3, and Euler, borrowing more than $236 million in $wETH. The incident began at 17:35 UTC, when the attacker called LayerZero's lzReceive function on the EndpointV2 contract. A forged cross-chain packet allegedly fooled Kelp's bridge into releasing rsETH to wallets that had been pre-funded via Tornado Cash. Investigator @zachxbt flagged the attack shortly before 3 PM ET. Kelp's emergency multisig pause went live at 18:21 UTC, 46 minutes after the initial drain. Two additional attempts at 18:26 and 18:28 UTC reverted; each appeared to target another 40,000 rsETH, roughly $100 million. The stolen 116,500 rsETH equals about 18% of rsETH's circulating supply of roughly 630,000. With rsETH deployed across more than 20 networks, market participants are questioning the backing of wrapped versions on L2s. In response, @aave, SparkLend, Fluid, and @upshift_fi froze rsETH markets. Aave founder Stani Kulechov said Aave's contracts were not compromised and that rsETH now has "no borrowing power." Aave's Umbrella backstop, which replaced the legacy Safety Module in late 2025, is facing its first major real-world stress test. Elsewhere, @LidoFinance paused earnETH deposits. @ethena_labs paused its LayerZero OFT bridges for about six hours as a precaution despite reporting no rsETH exposure. $AAVE fell roughly 10% on the news. The exploit surpasses the April 1 @DriftProtocol hack ($285 million, linked to North Korea), making it the largest DeFi exploit of 2026 to date.

Curve founder Michael Egorov said the KelpDAO exploit caused roughly $292 million in losses and left Aave with bad debt, underscoring vulnerabilities in today's "non-isolated lending" model. In a post dated April 19 (UTC+8), Egorov noted that while the approach scales well, it concentrates risk and demands stronger risk controls. He added that fully isolated and hybrid designs could be practical alternatives, and pointed to Aave v4's proposed "hub-and-spoke" architecture as a potential path toward more secure lending structures. (Source: ODAILY)

Andre Cronje, co-founder of Sonic Labs and founder of Flying Tulip, said on April 19 that his team is still investigating the L0/rsETH incident. Early findings indicate around $200 million in rsETH may have been stolen, likely stemming from a compromised private key or a configuration error. Cronje said the stolen rsETH was later deposited into Aave to borrow ETH, citing insufficient rsETH liquidity. He noted the position was technically collateralized, and added that even in a scenario where collateral proved inadequate, Aave's token and safety module are designed to act as the first layer of protection against bad debt. He also cautioned that Aave has no mechanism to reimburse user losses, meaning an extreme outcome could spark a bank-run style withdrawal wave. Even so, he assessed the risk as contained given Aave's roughly $7 billion in ETH, versus about $100 million in withdrawals and PUT's $17 million in exposure. Cronje emphasized that the priority is maintaining PUT user liquidity. He said the team has withdrawn all ETH from Aave into its own wrapped contract after Aave's available liquidity fell below their minimum threshold.

April 19 — Curve founder Michael Egorov said he hopes Aave can address fallout from the recent Kelp DAO exploit, which he claimed resulted in roughly $292 million in losses and left Aave with bad debt. Egorov argued the incident highlights a core vulnerability of the widely used "non-isolated lending" model: it scales well, but concentrates risk, making rigorous risk management essential—an area where he noted Aave has historically performed strongly. He outlined potential alternatives, including a fully isolated design like Curve Finance's market, or a hybrid approach that is more complex to implement but workable. Egorov added that the market has yet to fully appreciate the benefits of these structures, and suggested Aave v4's hub-and-spoke architecture could be a move toward a semi-isolated, more secure framework.

April 19 — Andre Cronje, co-founder of Sonic Labs and founder of Flying Tulip, said his team is continuing to investigate the L0/rsETH incident. Early findings indicate a compromised private key or a configuration mistake may have enabled the theft of roughly $200 million worth of rsETH. Cronje said the rsETH was then deposited into Aave to borrow ETH, citing limited rsETH liquidity. He noted the position remains collateralized from a technical standpoint, and added that even in an under-collateralized scenario, Aave's token and security module are designed to serve as a first line of defense against bad debt. He also stressed that Aave has no mechanism to reimburse user losses, meaning that in an extreme scenario the situation could trigger a "bank run." Still, he said the potential fallout appears contained given Aave's roughly $7 billion in ETH versus about $100 million in withdrawals and PUT's $17 million exposure. Cronje said the priority remains protecting users' PUT liquidity. As Aave's available liquidity dropped below the team's minimum threshold, they withdrew all ETH from Aave and moved it into their own wrapped contract.