Kelp DAO Cross-Chain Bridge Vulnerability May Cause Massive Bad Debt for Aave, Potential Losses Up to $230 Million

BroadChain has learned that at 08:16 on April 21, according to PANews, Aave's incident report disclosed that due to a vulnerability in the Kelp DAO cross-chain bridge, attackers forged cross-chain messages to release 116,500 rsETH from the Ethereum side bridge. They deposited 89,600 of these into Aave as collateral and borrowed approximately $190 million worth of ETH and related assets, leaving these loans effectively unsecured. Reports from Aave Labs and LlamaRisk indicated that Aave froze the rsETH market within hours and set the loan-to-value ratio to zero to control risks. The final scale of losses depends on how Kelp DAO handles the funding gap: if losses are distributed among all rsETH holders, rsETH is expected to depeg by about 15%, resulting in approximately $123 million in bad debt for Aave; if losses are concentrated on Layer 2 networks, the bad debt could rise to about $230 million, primarily affecting networks like Arbitrum and Mantle. Following the incident, Aave's total value locked (TVL) withdrew about $6 billion. Currently, the Aave DAO treasury, holding approximately $181 million in assets, is discussing solutions with ecosystem participants to cover potential losses.