Aave $300M borrowing spike signals liquidity crunch after KelpDAO exploit

Approximately $292–293 million worth of rsETH was illicitly released from KelpDAO's LayerZero-powered bridge and routed into major lending markets, triggering an immediate spike in borrowing on Aave and other platforms. The wave of borrowing against unbacked rsETH exposed a sudden liquidity shortfall in WETH/ETH pools.

On-chain traces and industry reports indicate the attacker deposited the drained rsETH as collateral across Aave V3 and V4 (and other venues), borrowing large amounts of WETH and, in doing so, creating undercollateralized positions. In response, Aave moved quickly to freeze rsETH markets on affected deployments and remove borrowing power for the asset while teams assessed bad-debt exposure.

The immediate market impact was a sharp rise in utilization rates for WETH pools and swift outflows from Aave's total value locked, with several lending pools tightening access or pausing operations. These dynamics squeezed funding for short-term ETH/derivative liquidity and amplified stress on stablecoin and ETH-based lending corridors.

LayerZero's preliminary investigation pointed to a compromised verifier/RPC configuration tied to KelpDAO's single-validator setup and suggested attribution to a sophisticated state-linked actor, likely the Lazarus Group. LayerZero emphasized the incident was isolated to KelpDAO's rsETH configuration but warned that single-point-of-failure designs in cross-chain bridges significantly increase systemic risk.

Market strategists say the episode is a stress-test for cross-protocol risk models: immediate priorities are quantifying bad debt, protecting core depositors, and coordinating any recovery or bounty negotiations. Medium-term outcomes could include stricter collateral standards for liquid restaking tokens, expanded insurance backstops on lending platforms, and renewed focus on decentralised verifier redundancy in bridge designs.