The $2.92 Billion KelpDAO Hack Triggers Chain Reaction: Aave Withdraws over $54 Billion, Lending Market Risk Reassessed

**KelDAO Hack: $2.92B rsETH Stolen via LayerZero Bridge, Aave Responds to Risks** On April 19, multi-chain liquidity staking platform KelDAO was hacked early that morning. The attacker transferred 116,500 rsETH—valued at approximately $2.92 billion—from KelDAO’s LayerZero cross-chain bridge. Roughly 46 minutes later, KelDAO took emergency action: it paused its multisig to freeze core components (including the LRT deposit pool, withdrawal contract, oracle, and rsETH token) and suspended related contracts on its mainnet and several L2 networks. The protocol is conducting root cause analysis with LayerZero and other partners. Two follow-up attacks by the hacker failed, as the pause measures effectively halted further losses. The attacker had attempted to transfer an additional 40,000 rsETH (≈$1 billion); if successful, total losses could have swelled to ~$3.91 billion. ### Aave Impact The Aave token dropped ~10% amid market fears the lending protocol could face defaults. Aave froze rsETH markets in its V3 and V4 versions, clarifying the issue stems from the rsETH asset—not the protocol’s smart contracts. The team is assessing post-hack borrowing activity and noted it will “explore paths to cover gaps” if defaults occur. ### Hacker Actions & Market Reactions Most stolen rsETH was deposited into Aave as collateral to borrow ETH; a small portion was sold directly for ETH. In total, the hacker acquired 106,466 ETH (≈$2.5 billion). Following the hack, over $54 billion in assets were quickly withdrawn from Aave for hedging—including 65,584 ETH ($154 million) reclaimed by Justin Sun. Aave’s ETH fund utilization rate briefly hit 100%. ### Industry Commentary - **Curve Founder Michael Egorov**: “This incident ties to the widespread ‘non-isolated borrowing’ framework. It’s scalable but high-risk—risk management is critical. Aave V4’s hub-and-spoke architecture may move toward a semi-isolated, more secure model.” - **Crypto KOL benmo.eth**: “KelDAO’s rsETH theft shattered Aave’s ‘security halo.’ Whales are reexamining unified lending risks. Aave V4 and modular lending could trend upward, accelerating DeFi’s shift from expansion to conservative security—while addressing AI-powered threats like Anthropic Mythos.” - **Bankless Co-founder Ryan Sean Adams**: “Crypto hacks are at an all-time high, fueled by AI giving attackers ‘dark superpowers.’ Defenses must catch up fast; time is running out.”