The fallout from the Kelp DAO hack did not stop at the $292 million stolen. Within 24 hours, the shockwave hit Aave — DeFi's largest lending protocol. Over $5.4 billion in ETH drained from the pool. The utilization rate spiked to 100%. AAVE dropped 20%, LayerZero's ZRO token nearly 30%. This is not a technical glitch: it is a bank run.
Why $5.4 Billion in ETH Left Aave
The Kelp DAO attacker did not simply drain the rsETH bridge. They deposited the stolen rsETH as collateral on Aave V3 and V4 to borrow real ETH — leaving roughly $236 million in bad debt backed by a now-worthless asset.
Lookonchain data is unambiguous: more than $5.4 billion in ETH exited Aave's WETH pool, pushing utilization to 100% and effectively freezing new withdrawals. Aave founder Stani Kulechov confirmed via X that the protocol's own contracts were not compromised. The exploit was external. But confidence was not.
Earlier today we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate.
— Kelp (@KelpDAO) April 18, 2026
We are working with @LayerZero_Core, @unichain, our auditors and top security experts on RCA.
We will keep you…
Justin Sun Moves First: $154 Million in a Single Transaction
Tron founder Justin Sun was the first major whale to run: 65,584 ETH withdrawn in a single move, worth over $154 million. Dozens of other large holders followed immediately. Most capital migrated to Spark; a significant portion moved to cold storage.
The ripple effect on prices was immediate:
- AAVE: from $115 to $91.89 (-20% in hours)
- ZRO (LayerZero): down nearly -30% before a partial recovery
- KERNEL (Kelp ecosystem): -11%
- ETH: retesting $2,300 as critical support
Bad Debt and the DeFi Composability Trap
The structural problem runs deeper. rsETH was whitelisted as collateral not only on Aave, but also on Compound and Euler — on the assumption that the token remained fully backed. That assumption broke. Aave's Umbrella backstop could theoretically absorb some losses, but within hours the team shifted language from "we will use Umbrella" to "we will evaluate how to cover the deficit" — a vocabulary change that signals genuine uncertainty.
For a deeper analysis of how DeFi's composability becomes its greatest vulnerability, our DeFi 2026 investment thesis piece examines exactly this dynamic — how a single point of failure cascades through interconnected protocols.
What to Watch in the Next 48 Hours
The entire liquid restaking sector is now under scrutiny. Kelp is the second-largest player in the EigenLayer ecosystem after Ether.fi — its TVL impact weighs on the entire restaking narrative. Lending protocols are already reassessing risk parameters for all liquid restaking tokens (LRTs).
DeFi is powerful because it is composable. But composability — when a single piece fails — turns every connected protocol into a domino. The Aave weekend proves it. Anyone who thought "Aave is solid" was sufficient risk analysis is now paying the price.
