Aave Deposits Fall $15B After Kelp DAO Exploit

Aave deposits just had their worst week of 2026. Roughly $15 billion has walked out the door of the biggest DeFi lender since Saturday, and the trigger is no mystery. Last weekend’s Kelp DAO exploit drained $293 million in restaked Ether from a LayerZero bridge, and the attacker used Aave as the exit door. Now the protocol is staring down a bad-debt hole between $123 million and $230 million, and depositors are not waiting around to see which number sticks.

How Fast Did Aave Deposits Actually Leave the Protocol?

Fast. Brutally fast. Supplied value on Aave sat at $45.8 billion on Saturday morning, before the Kelp DAO bridge went sideways. By Wednesday it was $30.8 billion, according to Aavescan. That is a one-third drawdown in four days on a protocol that usually measures outflows in the low single digits.

The pain was concentrated on the Wrapped Ether side of the book. Aave’s v3 WETH market briefly hit 100% utilization, meaning every last unit of available WETH was borrowed and no liquidity was left for anyone trying to pull their coins out at the front door. Users who hit withdraw and got nothing did what you would expect them to do: they queued up, they got louder, and they moved what they could to rival venues the moment liquidity came back.

This is the part the original coverage downplayed. A lending protocol locking up at full utilization for even a few hours is a trust event, not a technical footnote. People remember it.

• Saturday TVL: $45.8 billion
• Wednesday TVL: $30.8 billion
• Net outflow: roughly $15 billion in four days
• WETH market utilization peak: 100%

What the Kelp DAO Exploit Actually Did

The attack hit Kelp DAO’s LayerZero-powered rsETH bridge on Saturday. The exploiter walked away with about 116,500 rsETH, worth roughly $293 million at the time of the drain. That alone would have been a bad weekend for any DeFi team. What made it a systemic event was the second leg of the trade.

Instead of simply selling the stolen restaked ETH, the attacker deposited a chunk of it into Aave and borrowed against it. Aave’s incident report puts the figure at 89,567 rsETH posted as collateral. When rsETH’s peg snapped, that position turned into bad debt the protocol could not liquidate cleanly, because the collateral token itself was the thing that had just been compromised.

Call it what it is. The Kelp exploit was a restaking hack on paper and an Aave hack in practice.

The asset bundled risks across restaking, bridging and lending layers, allowing the impact to spread far beyond the initial exploit. It reinforces the need for a more strong collateral framework and a more holistic security approach to address the systemic vulnerabilities of yield-bearing assets.

$123 Million or $230 Million? The Two Scenarios on the Table

On Monday, Aave’s risk manager laid out two ways to clean up the mess, and they land in very different places for token holders.

Scenario one spreads the losses across every rsETH holder on Ethereum mainnet and every supported layer-2. That version leaves Aave carrying about $123 million in residual bad debt. Scenario two shifts the full shortfall onto layer-2 holders only, which pushes Aave’s bad-debt number up to roughly $230 million but keeps mainnet rsETH holders whole.

Prediction markets are already pricing the outcome. On Polymarket, about 20% of traders are wagering that Kelp DAO will socialize the losses across rsETH holders on mainnet rather than pin the shortfall on L2 holders. In plain English, most of the smart money thinks layer-2 holders are going to eat it.

• Scenario A: socialized losses across all rsETH holders. Aave bad debt: ~$123M
• Scenario B: layer-2 holders absorb the full shortfall. Aave bad debt: ~$230M
• Polymarket odds on mainnet socialization: 20%

SparkLend Quietly Wins the Week

Money does not disappear when it leaves a lending protocol. It goes somewhere. This week the biggest somewhere was SparkLend, the fourth-largest lending protocol, which added $1.3 billion in TVL since Saturday. Blockchain analyst EmberCN flagged the rotation on X on Wednesday and the numbers back him up.

That is not a full catch of Aave’s $15 billion bleed, not even close. A lot of the withdrawn capital looks to have gone into stablecoins on centralized venues, into cold storage, or simply parked on the sidelines waiting for Aave’s incident response to play out. But Spark is the obvious on-chain winner, and the gap between Aave’s bad week and Spark’s good one is going to get talked about at every DeFi governance meeting this month.

The cynical read: depositors did not flee DeFi. They fled Aave. There is a difference, and it matters for how the protocol pitches itself once the dust settles.

What Happens to WETH Reserves and Withdrawals Now?

Aave unfroze WETH reserves on the Ethereum Core V3 market on Tuesday, which let users supply WETH to the V3 lending protocol again. That fix does not extend everywhere yet. WETH reserves on Ethereum Prime, Arbitrum, Base, Mantle and Linea remain frozen as of Wednesday, which means anyone trying to move size across those deployments is still waiting.

The governance forum is where the next fight happens. Token holders have to vote on which bad-debt scenario goes live, and that vote will determine whether rsETH holders on mainnet get cut in or left whole. Whichever way it breaks, Aave’s treasury is almost certainly writing a check before this is over. The only question is how big.

Interconnectedness is a double-edged sword, as Talos put it this week. On the upside it lets capital flow efficiently across restaking, bridging and lending. On the downside it lets a single bridge exploit turn into a $15 billion deposit run and a nine-figure bad-debt problem at the biggest lender on Ethereum. Pick which edge you want.

This article is for informational purposes only and does not constitute investment advice. Every investment and trading decision involves risk. Readers should conduct their own research before making any financial decisions.