Aave's TVL drops by $8.6 billion after a hack on Kelp DAO, leading to significant withdrawals and market concerns.
Aave, a prominent crypto lending platform, has seen its total value locked (TVL) drop dramatically from $26.3 billion to $17.7 billion within just two days, as reported by DefiLlama.
The AAVE token's value also took a hit, falling over 15% to $91, resulting in a market capitalization decline from $1.8 billion to $1.3 billion.
All pools for USDT and USDC in Aave v3 have been entirely drained, with $5.1 billion in assets now frozen, accessible only after the influx of new liquidity or repayment of loans.
Kelp Hack's Ripple Effects
The steep decline in Aave's metrics was precipitated by a significant hack of the Kelp liquid restaking protocol. On April 18, hackers stole 116,500 rsETH, worth approximately $293 million, from the Kelp DAO cross-chain bridge, which operates on LayerZero.
The attackers used the stolen tokens to collateralize loans in Aave v3, borrowing around $196 million, while their overall positions across Aave, Compound, and Euler reached about $236 million. This left Aave with a shortfall of roughly $195 million, according to Lookonchain.
“Due to the KelpDAO exploiter borrowing over 82,600 $ETH ($195M) from #Aave using $RSETH as collateral, bad debt has appeared on #Aave,” Lookonchain noted.
Prominent figures in the crypto space, such as Curve Finance founder Mikhail Egorov, have raised concerns regarding Aave's exposure to questionable collateral and unrecoverable debts. He stated, “Aave has rsETH that cannot be sold, and there is no ETH because it is all tied up in loans.”
Initially, Aave's project team suggested that the Umbrella reserve fund could cover the shortfall, but they later shifted to exploring compensation options instead.
The rsETH markets on Aave V3 and V4 have been frozen to prevent any further suspicious activities following the Kelp DAO exploit.
Several other protocols, including Curve Finance and Ethena, have halted the use of the Kelp DAO bridge, and the fallout has extended to Solana, where USDC deposit rates have surged and reserves have been depleted.
The total TVL across the DeFi sector has dropped from $99.4 billion to $85.8 billion as a result of these developments.
Kelp DAO Investigation Underway
Kelp DAO is actively investigating the hack, while LayerZero developers have released preliminary findings. They suspect that North Korean hackers, specifically the TraderTraitor group, orchestrated the attack.
LayerZero revealed that the attackers exploited vulnerabilities in the decentralized verified network (DVN) of LayerZero Labs, allowing them to deliver a false message to the network. Despite prior recommendations to diversify the DVN setup, Kelp opted for a single point of failure, which led to the exploit.
“Exploiting a single point of failure meant that the independent verifier could not intercept and reject the forgery,” LayerZero noted.
The investigation continues, with LayerZero cooperating with law enforcement to track the stolen assets, emphasizing that other applications and assets remain unaffected by the breach. Meanwhile, concerns about North Korean involvement in the Web3 space have been highlighted, with a recent report identifying 100 North Korean IT agents working in various companies.
