Aave has restored Wrapped Ether (WETH) borrowing functionality and loan-to-value ratios to pre-incident levels across six networks, completing Phase II of its recovery following the April 18 Kelp DAO exploit. The exploit resulted in $195 million in bad debt after hackers stole 116,500 rsETH tokens from Kelp’s LayerZero bridge and used them as collateral to borrow WETH on Aave V3. The restoration marks a critical step in stabilizing the protocol after a governance proposal passed to lift the WETH freeze that had been in place since the initial attack.
How the Kelp DAO Exploit Created $195 Million in Bad Debt
On April 18, state-backed actors exploited LayerZero’s bridge infrastructure to steal 116,500 rsETH tokens from Kelp DAO’s reserves. The stolen tokens were immediately deployed as collateral on Aave V3, where attackers borrowed approximately $195 million in WETH. This created cascading bad debt across the protocol. Aave founder Stani Kulechov responded by freezing WETH, rsETH, and wrsETH reserves as precautionary measures. Recovery efforts involved restoring rsETH backing using frozen Ether reserves and tokens donated by the DeFi United coalition, enabling users to withdraw their funds and restore protocol confidence.
TVL Decline and Current Market Conditions on Aave
Aave’s total value locked dropped $8 billion in the immediate aftermath of the exploit, falling from a March baseline of $23.5 billion to $14.8 billion as of Monday. Staking derivative deposits took significant hits: wstETH deposits fell $1.2 billion and weETH deposits declined $1.76 billion. However, conditions have begun to stabilize. According to Entropy Advisors, Ether utilization has dropped below the 90% threshold, with borrowing APY now at 1.9%. This repricing creates renewed opportunity for leveraged Ether strategies, though capital redeployment remains uncertain.
rsETH Oracle Migration and Bridge Sunsetting Timeline
Aave’s recovery strategy extended beyond WETH restoration. Earlier in May, Kelp DAO migrated rsETH to Chainlink as its oracle platform, replacing the previous LayerZero infrastructure that enabled the initial attack. On May 18, Kelp announced a phased bridge sunsetting across select networks, with a June 15 deadline for Optimism, HyperEVM, Unichain, Avalanche, and MegaETH. Users will face a 100 USDC recovery cost per address after June 15. This infrastructure overhaul addresses the root cause of the exploit while establishing clearer operational boundaries for Kelp’s restaking token ecosystem.
What Happens Next: Capital Redeployment and Protocol Risk
With wstETH and weETH loops returning to profitability, the critical question is whether capital flows back to leveraged Ether positions or remains on the sidelines. Users now have access to Aave’s native borrowing, Spark Protocol, and Morpho as competing venues. The protocol’s $8 billion TVL loss suggests lingering caution despite technical recovery. Full confidence restoration depends on sustained stability and successful completion of any Phase III recovery measures, though no such plan has been publicly announced.
