Key Highlights
- KelpDAO’s rsETH bridge suffered a $292–$293 million exploit, setting off a mass withdrawal from Aave totaling over $15 billion.
- Multiple Aave lending markets reached 100% utilization, trapping approximately $5 billion in USDT and USDC with withdrawals disabled.
- Protocol TVL plummeted from $48.5 billion to approximately $30.7 billion — representing a one-third reduction within just days.
- Security expert Natalie Newson from CertiK stated Aave’s “self-defense systems are down,” leaving bad debt vulnerable to expansion.
- The AAVE token currently trades near $91, maintaining position slightly above critical $90.47 support, facing resistance around $98.80.
One of DeFi’s premier decentralized lending platforms, Aave, finds itself grappling with a severe liquidity emergency after an external protocol breach set off a cascading withdrawal crisis that paralyzed its primary markets.
The crisis originated on April 18 when malicious actors identified and exploited a critical flaw in a LayerZero V2 bridge connecting Unichain to Ethereum. This vulnerability enabled them to extract approximately $293 million in rsETH from Kelp DAO while failing to burn the equivalent tokens on the originating blockchain.
The compromised tokens were subsequently deposited into Aave V3, where they served as collateral. Exploiting this position, the attacker secured loans totaling nearly $200 million in WETH. As word spread about the unbacked collateral backing these loans, a rapid exodus commenced.
Within a single 24-hour period, Aave experienced outflows exceeding $6.6 billion. Notable withdrawals came from high-profile entities including Justin Sun and cryptocurrency exchange MEXC. The ETH lending pool reached maximum utilization initially, followed quickly by both USDT and USDC markets.
When a lending protocol achieves 100% utilization, it signifies complete depletion of available liquidity. Under these conditions, user withdrawals become impossible, and the protocol loses its ability to execute liquidations.
DeFi analyst DeFi Warhol offered a straightforward assessment: “It actually means no liquidity available for withdrawals. Liquidations can’t be processed.” He noted that approximately $3 billion in USDT and $2 billion in USDC remain trapped without viable exit strategies.
Protocol Defense Mechanisms Compromised
CertiK’s senior blockchain security researcher, Natalie Newson, emphasized the gravity of Aave’s predicament.
“100% utilization doesn’t just mean a lack of liquidity; it means the protocol’s self-defense systems are down,” she explained. The absence of available liquidity prevents the closure of undercollateralized positions, allowing bad debt accumulation to continue unchecked.
Newson clarified that Aave wasn’t directly breached. “It got stuck due to the fallout from someone else’s bridge failure,” she noted. According to LlamaRisk’s analysis, potential bad-debt exposure ranges between $123.7 million and $230.1 million.
Aave’s governance responded swiftly — implementing a freeze on rsETH reserves, reducing loan-to-value ratios to zero, and modifying interest rate parameters. However, the TVL damage had already materialized.
Migration to Alternative Platforms
According to AmberCN’s April 22 report, cumulative withdrawals from Aave across three and a half days totaled $15.1 billion. The protocol’s TVL collapsed from $48.5 billion down to $30.7 billion.
Morpho similarly experienced $1.5 billion in outflows. Conversely, SparkLend attracted $1.3 billion in new deposits — with speculation suggesting some capital originated from the same large holders departing Aave.
Aave’s daily on-chain revenue declined from $1.1 million in early February to $625,000 as of this Monday.
When CoinDesk reached out to Aave founder Stani Kulechov for commentary, he responded: “I do not have anything useful to say.”
The AAVE token is currently valued at approximately $91.22, hovering marginally above the crucial support threshold of $90.47. The immediate resistance level aligns with the 20-day EMA positioned near $98.80.
