Aave Faces Up to $230 Million in Losses After Kelp DAO Exploit, Incident Report Finds

An Aave Labs and LlamaRisk incident report puts bad debt exposure at $124 million to $230 million depending on how Kelp DAO socializes losses from its $292 million bridge exploit.

Aave Labs and risk management firm LlamaRisk published an incident report on April 20 quantifying the lending protocol’s exposure to the April 18 Kelp DAO rsETH bridge exploit, outlining two bad-debt scenarios ranging from $123.7 million to $230.1 million.

The attacker deposited 89,567 rsETH across seven wallets on Aave as collateral and borrowed roughly $190 million in wrapped ETH and wstETH before markets were frozen, according to the report.

This story is an excerpt from the Unchained Daily newsletter.

The final damage figure depends on how Kelp decides to socialize losses. Under Scenario 1, losses are spread across all rsETH holders via a roughly 15% haircut on the token’s backing ratio, producing an estimated $123.7 million in bad debt across Aave’s affected markets. Under Scenario 2, losses are isolated to rsETH on layer 2 networks, pushing bad debt to $230.1 million concentrated on Mantle with a 71.45% WETH shortfall and Arbitrum with a 26.67% shortfall, while Ethereum mainnet rsETH remains unaffected.

The report noted that the Aave DAO treasury holds $181 million as of April 20, including $62 million in Ethereum-correlated holdings, $54 million in AAVE tokens, and $52 million in stablecoins. The DAO generated $145 million in revenue in 2025 and $38 million year-to-date in 2026. Service providers have made several indicative recovery commitments, according to the report.

But Aave’s bad debt concerns have also had knock-on effects. Users have withdrawn $6.6 billion from the protocol pushing WETH pools to 100% utilization. This has frozen liquidity across major chains, trapping remaining depositors and triggering a $300 million surge in stablecoin borrowing by users trying to unlock their positions. Founder Stani Kulechov confirmed Aave’s own contracts were not compromised, and the protocol continues to work through its options for covering the shortfall without triggering its Umbrella safety module.