Aave, one of DeFi’s largest lending protocols, shed $8.45 billion in deposits in 48 hours after attackers exploited a cross-chain bridge tied to liquid restaking project Kelp DAO, triggering a liquidity crisis that locked users out of their own funds.
Aave users couldn’t get their money out
The mechanics were simple and brutal. According to Lookonchain attackers deposited stolen rsETH as collateral on Aave and borrowed around $195 million in real Ethereum against it. The rsETH was worthless — it had been conjured from nothing — which means Aave was left holding bad debt the moment those loans went out. Freezing the rsETH markets stopped the bleeding, but didn’t undo it.
With those pools frozen and utilization hitting 100%, lenders had nowhere to go. Users who’d deposited ETH couldn’t withdraw. Some started borrowing stablecoins against their own deposits just to get liquidity out somehow, which made things worse. Rates on the affected pools jumped to 10–15% — not nearly enough to compensate for the risk of sitting on collateral nobody can sell.
Then the exits started. MEXC pulled $431 million. A whale wallet linked to trading firm Nonco pulled $405.7 million. Abraxas Capital took out $392 million. By Sunday, Aave had seen $8.45 billion in net withdrawals, dropping its TVL from $26.3 billion to $17.7 billion. The AAVE token fell 16% to around $91.
How the Kelp DAO bridge was exploited
The root cause was Kelp DAO’s cross-chain bridge, built on LayerZero infrastructure. Blockchain researcher Stacy Muur explained that attackers sent a “phantom” message that tricked the bridge into releasing 116,500 rsETH on Ethereum’s mainnet without burning the corresponding tokens on layer-2 network Unichain. The tokens were printed from nothing.
The exploit drained $292 million in a single transaction. Kelp DAO froze its core contracts 46 minutes after the drain was confirmed. LayerZero has said nothing publicly.
The biggest DeFi exploit of 2026
This is the largest DeFi exploit of 2026, and not the first bridge failure of the year. Drift Protocol was hit in a separate attack earlier, and the mechanism is familiar each time. The bridge infrastructure fails, collateral turns worthless, and protocols downstream absorb the damage.
According to Coindesk, Peter Chung from Presto Research said the Kelp incident points to weaknesses in bridge verification layers specifically, not smart contracts, which makes the problem harder to catch before it lands. Once the Kelp bridge failed, at least nine protocols froze or suffered losses: Aave, Compound, Euler, SparkLend, Fluid, and others. Total DeFi TVL dropped $13.2 billion in 48 hours, from $99.5 billion to $86.3 billion.
Who pays for Aave’s $195 million bad debt?
The answer remains unclear. Aave initially said its Umbrella reserve fund would cover the shortfall, then walked that back to “exploring avenues for compensation.” Curve Finance founder Mikhail Egorov put it plainly: Aave holds rsETH it cannot sell, all its Ethereum has been borrowed out, and there is nothing to withdraw against.
Panic will ease once someone officially agrees to absorb the $195 million. What will not recover as easily is the credibility. DeFi’s critics have spent years arguing that trustless systems are only trustless until they are not. This week gave them another data point to back this claim.
