Aave in Crisis: rsETH Exploit Triggers $7B TVL Collapse, $5.4B ETH Withdrawals

Aave Faces Major Crisis After rsETH Exploit Sparks $7B TVL Plunge and Sharp AAVE Sell-Off

Aave, one of DeFi’s largest and most established lending protocols, is navigating a significant stress event following a major exploit involving rsETH, the liquid restaking token from KelpDAO. The incident has triggered a rapid $7 billion collapse in Aave’s total value locked (TVL), massive ETH withdrawals exceeding $5.4 billion, and a sharp correction in the AAVE governance token of around 15-19% in a single day.

The exploit did not compromise Aave’s core smart contracts. Instead, it originated from a vulnerability in KelpDAO’s cross-chain bridge (built on LayerZero), allowing an attacker to drain approximately 116,500 rsETH (valued at roughly $290-293 million at the time, or about 18% of rsETH’s circulating supply). The attacker then used this unbacked rsETH as collateral on Aave V3 and V4 markets across Ethereum mainnet and Arbitrum to borrow large amounts of WETH (and some wstETH), creating substantial bad debt when the rsETH collateral lost its peg and became effectively unliquidatable.

In response, the Aave Guardian quickly froze rsETH and wrsETH markets across relevant deployments to prevent further borrowing against the compromised asset. Aave emphasized that all pools remain safe and operational, with the incident isolated to the rsETH collateral. The protocol is actively reviewing post-exploit borrows and exploring options — including its Umbrella safety module — to address any resulting bad debt.

Massive Capital Flight and Liquidity Stress

The news triggered an immediate panic among users. On-chain data shows over $5.4 billion in ETH withdrawn from Aave in a short window as depositors rushed to protect their funds amid concerns about potential bad debt spillover and high utilization rates in WETH pools (which approached or hit 100% in some markets).

At the same time, exchange inflows for the AAVE token surged dramatically. Cumulative inflows across major platforms exceeded 355,000 AAVE, equivalent to approximately $32 million. This heavy selling pressure on exchanges reflected both system-wide investor stress and a clear deterioration in sentiment toward the protocol.

The AAVE token experienced a sharp intraday correction of around -15% (with some reports citing up to -19% at the lows), dropping amid the broader risk-off reaction and forced liquidations in derivatives markets.

Why the Exploit Hit Aave So Hard

The mechanics highlight vulnerabilities in composability across DeFi:

• The attacker exploited the KelpDAO bridge to mint or release unbacked rsETH.
• This inflated collateral was deposited on Aave and used to borrow against more stable assets like WETH.
• Once the rsETH peg collapsed, the borrowed positions became difficult or impossible to liquidate normally, leaving Aave with bad debt exposure (initial estimates ranged from $177M to $250M+ in the WETH pools).

Aave’s rapid freeze of rsETH markets limited further damage, but the event exposed how quickly contagion can spread through interconnected protocols, even when the core lending contracts remain secure.

Market Reaction and Derivatives Pressure

The combination of bad debt concerns, massive withdrawals, and negative sentiment led to forced selling. Long positions in AAVE derivatives faced significant liquidations, further amplifying the downward price move. Open interest likely contracted as leveraged traders exited amid the uncertainty.

Despite the stress, Aave’s core protocol continues to function, and the team has communicated transparently via governance forums and social channels. The incident represents one of the largest DeFi-related events of 2026 so far and serves as a real-world stress test for Aave’s risk management, safety modules, and cross-chain collateral handling.

Outlook for Aave and Broader Implications

This event underscores ongoing risks in DeFi, particularly around liquid restaking tokens, cross-chain bridges, and collateral volatility. For Aave specifically:

• Short-term: Focus remains on assessing and mitigating bad debt, monitoring WETH pool health, and restoring user confidence.
• Medium-term: The protocol may see increased scrutiny on collateral onboarding, risk parameters, and bridge dependencies.
• Long-term: Aave’s battle-tested infrastructure and large user base provide resilience, but repeated stress events could slow TVL growth if not addressed decisively.

AAVE token holders and DeFi participants should watch for updates from the Aave Guardian, governance proposals regarding bad debt resolution, and any signs of stabilization in TVL and withdrawals.

The rsETH incident has highlighted both the innovation and fragility of interconnected DeFi systems. While Aave itself was not hacked, the cascading effects demonstrate how quickly external exploits can impact even the most established protocols.

As the situation develops, transparency from the Aave team and effective management of the bad debt will be critical in determining how quickly confidence — and TVL — can recover.

Georgi Shopov publication: "Aave in Crisis: rsETH Exploit Triggers $7B TVL Collapse, $5.4B ETH Withdrawals" was written for 24crypto.news

---

News from today

---

Related news

Kelp DAO Moves to Chainlink CCIP After $292M rsETH Bridge Exploit

Litecoin Network Stabilizes After Major Security Exploit Triggers Deep Chain Reorganization

Bitcoin Plunges Below $71K: Islamabad Talk Collapse Triggers $1B Liquidation Event

Aave Liquidity Crisis: $5 Billion Locked as DeFi Lending Giant Hits 100% Utilization

More news with author: Georgi Shopov