KelpDAO and Aave Hit by $292M rsETH Exploit, AAVE Drops 10%

A major security breach rocked the decentralized finance space on April 18, 2025, as crypto investigator ZachXBT flagged a sophisticated exploit targeting KelpDAO's rsETH liquid restaking token, resulting in an estimated $292 million in losses and triggering sharp declines across related assets.

According to on-chain analysis, the attacker exploited a cross-chain vulnerability to mint between $280 million and $300 million worth of rsETH on EigenLayer. The fraudulently minted tokens were then used as collateral on Aave V3 to borrow large amounts of ETH and Wrapped ETH (WETH). To obscure the transaction trail, the stolen funds were subsequently routed through Tornado Cash. Blockchain data confirmed that approximately 116,500 rsETH tokens were drained in the attack, with the exploit traced back to a suspicious call on LayerZero's EndpointV2 contract at 17:35 UTC, which triggered KelpDAO's bridge contract to release funds to an attacker-controlled wallet.

The fallout for Aave V3 has been significant, with reports suggesting the protocol now faces up to $177 million in potential bad debt due to the compromised collateral. KelpDAO responded swiftly by pausing rsETH contracts across the Ethereum mainnet and multiple Layer 2 networks, while coordinating with LayerZero, Unichain, auditors, and security experts to investigate the root cause. Aave also confirmed that its own contracts were not directly exploited, freezing rsETH markets on both Aave V3 and V4 as a precautionary measure and pledging to explore deficit mitigation options if bad debt materializes.

Market reaction was immediate. AAVE token fell over 10% to approximately $105.73, driven by panic selling, while Ethereum declined around 3% in the same window. The incident underscores persistent vulnerabilities in cross-chain DeFi infrastructure and raises fresh concerns about collateral risk management in lending protocols.