Aave Still $8B Below Pre-Hack Deposit Level

As of the latest data from DefiLlama, deposits on Aave total $18.1 billion, roughly 31% lower than the $26.1 billion recorded the day before the Kelp hack in April.

The lending protocol's own code remained intact. The issue was the collateral backing its loans, which failed in a location beyond the reach of those loan contracts.

What the Kelp Hack Actually Broke

On April 18, attackers targeted the method by which Kelp DAO's cross-chain bridge verified incoming messages, not its lending functionality. Kelp operates as a liquid restaking protocol, with rsETH serving as its receipt token.

$AAVE dropped 20% today after the KelpDAO rsETH exploit.

The exploit triggered a wave of whale selling and a record spike in $ETH utilization across the lending protocol.

Th @aave team told BeInCrypto that the situation is contained to the V3 ETH market only, with V4 completely… pic.twitter.com/LvDCDHCdmN

— BeInCrypto (@beincrypto) April 19, 2026

Someone who holds rsETH does not possess ether directly. Instead, they have a claim on staked ether that was first transmitted across a bridge. The attackers compromised the data feeds the bridge relied upon, inserting a fraudulent message. This resulted in the release of 116,500 rsETH, valued at roughly $292 million — nearly 18% of the token's total supply — with no backing.

Halborn, a security firm, attributed the theft to a configuration with a single verifier and compromised data nodes. Chainalysis connected the perpetrators to the Lazarus Group from North Korea. No smart contract was breached.

These unbacked tokens subsequently entered lending platforms. The attackers deposited 89,567 rsETH into Aave and used it to borrow approximately $193 million.

Within an hour, Aave had frozen rsETH in 11 markets, and WETH was frozen two days afterward. That same evening, BeInCrypto advised Aave WETH suppliers to withdraw, just hours before those pools reached full utilization.

“Aave’s smart contracts were not compromised at any point during this event. All protocol logic, including supply, repayment, and liquidation mechanisms, continued to function as designed.”

According to Aave's incident report, the bad debt would be $123.7 million if losses were allocated evenly. When considering only the bridged rsETH, that figure rose to $230.1 million.

What Borrowers Are Trusting

Other protocols stepped in to fill the gap. A recovery plan funded by a coalition secured pledges of approximately 69,570 ETH, against a shortfall of 75,081 ETH.

The Arbitrum Security Council froze 30,765 ETH of the stolen funds, and its DAO sent that amount to Aave in June. A US court order, obtained by creditors with judgments against North Korea, continues to cast uncertainty over the money.

Depositors are taking longer to return than the recovery of the balance sheet suggests. Aave's deposits stood at $12.5 billion at the end of June and have risen to $18.1 billion this week. The AAVE token is trading near $124, a 3.8% decline on the day.

This kind of structure exists in other places as well. Wrapped Bitcoin and similar receipt tokens insert an intermediary between the borrower and the underlying asset.

Three things are worth checking before posting any of them as collateral.

• The number of independent parties required to authorize the token's bridge
• Whether the lending market operates in isolation or shares losses with adjacent markets
• Whether the collateral itself represents a claim on another claim

For borrowers who lost access in April, those questions went unanswered. The incident demonstrated the price of failing to ask them.