The Kelp DAO hack has severely impacted Aave, causing a drastic drop in its TVL and raising concerns about DeFi security.
A recent hack of the Kelp DAO liquid restaking protocol has raised significant concerns about the security of decentralized finance (DeFi) platforms, particularly affecting Aave, which had been viewed as a safe haven in the sector. On April 18, hackers exploited vulnerabilities in Kelp DAO, stealing $293 million, which led to a dramatic decline in Aave's total value locked (TVL) from $26.3 billion to $17.7 billion within just two days.
The breach occurred via a cross-chain bridge using LayerZero, linked to a North Korean hacking group. Attackers compromised two RPC servers, allowing them to manipulate the system and extract a large sum of rsETH. During the attack, stolen funds were quickly placed as collateral in Aave, leading to significant borrowing and the freezing of assets.
Aave's TVL drop was accompanied by a significant decline in the price of its native token, AAVE, which fell by 15%. The incident not only impacted Aave but also caused a ripple effect across the entire DeFi sector, with total TVL decreasing from $99.4 billion to $85.8 billion, representing a 12% decline.
Immediate Impact on Aave
As a result of the hack, Aave experienced a liquidity crisis with its USDT and USDC pools being completely drained. The protocol has temporarily frozen $5.1 billion in assets, which can only be accessed once new liquidity is injected or existing loans are repaid. The incident has also led to a 100% utilization of USDC and USDe markets, further complicating the situation.
In response to the hack, the newly implemented Umbrella module, designed to handle deficits automatically, became the first real test of its functionality. While initially suggesting it would cover losses, the Aave team has since indicated they are still exploring compensation methods.
Potential Outcomes and Broader Implications
Experts have outlined three possible scenarios for addressing the losses incurred from the hack: socializing losses among rsETH holders, shifting losses to Layer 2 networks, or reverting to a snapshot before the hack occurred. Each of these outcomes carries significant implications for user trust and the future of lending protocols in DeFi.
Moreover, the incident has underscored the systemic risks present in DeFi, particularly regarding cross-chain bridges and the contagion effects of pool lending. While some community members have pointed to alternative platforms like Morpho as safer options, experts warn that isolated markets may not eliminate risks but merely change their form.
As the Aave team continues to investigate and respond to the incident, the future of DeFi lending protocols hangs in the balance, with potential long-term effects on user confidence in these systems.
