Five months after the Kelp DAO exploit, Aave reports total deposits of $18.1 billion. This figure remains approximately 31% lower than the $26.1 billion recorded prior to the April incident. The protocol's own smart contracts remained functional throughout the event, as the issue stemmed from the collateral assets.
The attack targeted the cross-chain bridge of the liquid restaking protocol Kelp DAO. Attackers manipulated data feeds to release 116 500 rsETH, valued at approximately $292 million. Security firm Halborn identified a single-verifier setup as the vulnerability, while Chainalysis linked the incident to the Lazarus Group.
Following the exploit, attackers supplied 89 567 rsETH to Aave and borrowed $193 million. Aave responded by freezing rsETH across 11 markets and WETH shortly after. The protocol estimated bad debt between $123.7 million and $230.1 million, depending on the isolation of the bridged assets.
Recovery efforts included a coalition-funded plan to address a 75 081 ETH shortfall. The Arbitrum DAO transferred 30 765 ETH to Aave in June, though these funds remain subject to a US court order related to North Korean creditors. AAVE token currently trades near $124, reflecting a 3.8% daily decline.
