Its TVL fell from $26.4 billion to $18.6 billion. Hackers reportedly used stolen rsETH tokens as collateral on Aave v3 to borrow wETH, which left the protocol with an estimated $195 million in bad debt. Aave froze several rsETH and wETH markets, while other protocols connected to rsETH or LayerZero also paused activity.
Aave TVL Crashes After Kelp DAO Hack
Aave, one of the largest decentralized lending protocols in crypto, saw a huge drop in total value locked (TVL) over the weekend after fallout from the $293 million Kelp DAO exploit. According to data from DeFiLlama, Aave’s TVL declined from approximately $26.4 billion to $18.6 billion by Sunday, wiping out close to $8 billion in locked assets and causing the platform to lose its position as the largest DeFi protocol.
DeFi protocol rankings (Source: DeFiLlama)
The chain reaction began when hackers stole 116,500 rsETH tokens, valued at around $293 million, from Kelp DAO’s LayerZero-powered bridge. The attackers then used the stolen rsETH as collateral on Aave v3 to borrow wrapped Ether (wETH). Because the collateral was compromised, the borrowing activity reportedly left Aave exposed to roughly $195 million in bad debt. This is according to blockchain analytics platform Lookonchain.
The impact on Aave’s lending markets was immediate. Stablecoin pools for USDT and USDC on Aave v3 reached 100% utilization. This means that almost all available liquidity was borrowed out.
As a result, more than $5.1 billion in stablecoins became temporarily unavailable for withdrawal unless fresh liquidity entered the system or outstanding loans were repaid. At one point, only $2,540 remained withdrawable from Aave’s $2.87 billion USDT pool.
Investor confidence was shaken. The AAVE governance token fell by almost 20% over roughly 25 hours, from $112 on Saturday evening to around $89.50 the following day. At press time AAVE was trading hands at $91.14. Large withdrawals by major players added to pressure on the platform, with MEXC exchange reportedly removing $431 million and Abraxas Capital withdrawing $392 million.
AAVE’s price action over the past week (Source: CoinCodex)
In response, Aave froze rsETH markets on both v3 and v4 to prevent more suspicious borrowing. It later confirmed that rsETH on Ethereum mainnet is still fully backed by underlying assets. WETH reserves were also frozen across Ethereum, Arbitrum, Base, Mantle, and Linea as a precautionary measure.
The exploit also caused disruption beyond Aave. Several protocols linked to rsETH or the LayerZero bridge, including Curve Finance, Ethena, and BitGo’s Wrapped Bitcoin, paused bridge-related activity until the issue could be resolved.
Many people see the event is the first major stress test of Aave’s Umbrella security model, which launched in June of 2025 to protect against protocol bad debt while rewarding users. While Aave defended its overcollateralization and liquidation mechanisms, the incident shows how vulnerabilities in one protocol can quickly spread across interconnected DeFi ecosystems.
