Aave Enters Phase II of rsETH Recovery After $200 Million Bad Debt Crisis

May 11, 2026

Aave entered Phase II of recovering rsETH funds after a $200 million bad debt crisis stemming from an April 18, 2026 exploit of KelpDAO's rsETH bridge that Chainalysis preliminarily linked to the Lazarus Group. Attackers compromised RPC infrastructure and injected false data into a 1-of-1 DVN configuration, releasing approximately 116,500 rsETH that was then supplied to Aave as collateral. Before the exploit, Aave was the largest DeFi protocol with over $26 billion in deposits.

KelpDAO exploit mechanics

▪The forged message in the KelpDAO exploit released approximately 116,500 rsETH.
▪On April 18, 2026, attackers compromised RPC infrastructure tied to KelpDAO's rsETH bridge.
▪The attacker supplied compromised rsETH to Aave and borrowed against it, resulting in approximately $200 million in bad debt.
▪Chainalysis preliminarily linked the April 18, 2026 rsETH bridge attackers to Lazarus.
▪LayerZero banned the 1-of-1 DVN configuration on a protocol-wide basis after the KelpDAO exploit.

DeFi security failures

▪On the same day Aave expanded rsETH to a 93% loan-to-value ratio in eMode, SparkLend deprecated the asset entirely.
▪DeFi lost nearly $11 billion in total value locked in April 2026 following high-profile exploits on Drift and the KelpDAO bridge.
▪Before the exploit, Aave was the largest DeFi protocol by total value locked, with over $26 billion in deposits.
▪DeFi exploiters extracted over $635 million across 28 incidents in April 2026, the worst monthly total in over a year.
▪Immunefi research shows that DeFi losses declined by as much as 80% over the last several years because the sector hardened its code and attackers adapted.
▪DefiLlama puts the cumulative historical cost of DeFi hacks at $16.5 billion, with $7.7 billion specifically targeting DeFi.

Institutional capital migration

▪A Goldman Sachs survey found 35% of institutional investors named regulatory uncertainty their biggest blocker to digital asset investment.
▪EY-Parthenon and Coinbase's 2026 survey found 73% of institutional respondents plan to increase digital asset allocations in 2026, but 81% prefer registered vehicles.
▪A Goldman Sachs survey found 71% of institutional investors said they would increase digital asset exposure once regulatory clarity arrived.
▪Flowdesk launched an institutional AUSD vault in March 2026, using tokenized equities as collateral.
▪Aave Horizon, a permissioned market for tokenized securities and RWAs launched in August 2025, has grown to more than $440 million in deposits.

Regulatory framework development

▪The CLARITY Act, which would define jurisdictional and custodian standards for digital assets including tokenized securities, awaits consideration by the Senate Banking Committee as of May 14, 2026.
▪The GENIUS Act created the first federal framework for US stablecoins with mandatory 100% reserve backing, no rehypothecation, and custody standards.

DeFi recovery strategies

▪Aave entered Phase II of rsETH recovery following the $200 million bad debt crisis.
▪The rsETH crisis resulted in $200 million in bad debt on Aave's books, despite not a single line of Aave's contracts misbehaving.