Key Takeaways:
- Attackers obtained 116,500 rsETH from Kelp’s bridge on April 18, 2026, and deposited the tokens on Aave V3 as collateral to borrow wrapped ether (WETH).
- Aave’s WETH pool hit 100% utilization as $5.4B+ in outflows pushed TVL down 24.11%, with AAVE token falling 17.7% on April 19.
- Aave’s Umbrella backstop is expected to cover an estimated $177M–$200M in bad debt, with the project confirming the protocol’s contracts were not exploited.
Aave WETH Pool Hits 100% Utilization After rsETH Exploit Leaves $200M in Bad Debt
Once KelpDAO paused rsETH contracts in response to the exploit, the collateral backing those borrow positions became worthless. The loans could no longer be liquidated in any meaningful way, leaving Aave holding bad debt across its WETH reserves. Estimates place total borrowed value across Aave and smaller exposures on Compound and Euler at up to $200 million or more.
Aave confirmed the protocol’s own contracts were not exploited. “Aave’s contracts have not been exploited,” the project’s X account stated, describing the event as an issue tied to rsETH. The team froze rsETH markets on Aave V3 and V4, removed borrowing power against that collateral, and set loan-to-value ratios to zero in affected deployments.
Aave founder Stani Kulechov stated:
“rsETH has been frozen on Aave V3 and V4, the asset does not have any borrowing power as a measure due to KelpDAO bridge exploit that happened outside of Aave. Both Aave V3 and V4 does not have further exposure to rsETH.”
The freeze stopped new activity against rsETH, but it did not stop users from trying to exit the protocol entirely. The fear of bad debt spillover set off a wave of withdrawals that hit Aave’s ETH and WETH pools with force.
Outflows in ETH and WETH reportedly reached $5.4 billion within hours. As capital drained out, several reports said pool utilization in the WETH market climbed to 100%. At that level, no liquidity remains in the pool for suppliers to redeem against.
When a pool runs at full utilization on Aave, withdrawals stop working. Suppliers who want to exit cannot, because the protocol can only fulfill redemptions from liquidity that is sitting idle in the pool. With borrowers holding nearly everything, there is nothing left to pull.
Stablecoin pools felt pressure from the same dynamic. While USDC and USDT reserves had no direct exposure to rsETH, the broader exit pushed utilization in some stablecoin markets to high levels on certain deployments. Users reported failed and delayed withdrawals across those markets as available liquidity thinned out.
Aave’s total value locked (TVL) dropped from approximately $26.4 billion to $19.776 billion. Defillama data shows a 24.11% TVL decline as of April 19. The AAVE token fell 17.7% on the same day, according to market data, as holders priced in bad debt uncertainty and the mechanics of what an Umbrella activation might mean for staked positions.
Aave’s Umbrella system is the protocol’s built-in backstop for exactly this kind of event. If bad debt is confirmed, the mechanism can draw on reserves and, depending on the situation, may involve slashing staked AAVE to cover the deficit. The precise impact on depositors is still being determined.
Other protocols connected to overlapping liquidity pools, including Sparklend, as reported rate spikes and temporary pauses as capital shifted away from affected markets.
As of April 19, no new exploits or expansions of the incident have been reported. ETH pool utilization remains elevated, and full withdrawal access depends on either panic subsiding organically or the Umbrella mechanism settling the bad debt and restoring confidence in the reserves.
The protocol’s next steps likely center on completing a bad debt review, issuing a formal Umbrella resolution, and monitoring whether outflows stabilize as markets absorb the full picture of what the KelpDAO incident left behind.
