$8 Million Gone! The Shocking Kelp rsETH Hack: What Aave & Llamarisk Don’t Want You to Know!

On April 18, 2026, a significant exploit occurred affecting the decentralized finance (DeFi) landscape, specifically targeting Kelp's Layerzero V2 bridge. According to a detailed analysis by risk management firm Llamarisk, an attacker managed to mint an astonishing 116,500 rsETH without any corresponding burn, leading to potential bad debt estimates ranging from $123.7 million to $230.1 million across seven affected markets, depending on how Kelp decides to socialize losses.

The incident unfolded at 17:35 UTC during Ethereum block 24,908,285. The attack leveraged a Unichain-to-Ethereum route configured as a 1-of-1 DVN path, which allowed a single verifier to attest an inbound packet without requiring an outbound action. Llamarisk’s report detailed how the attacker forged a packet that was verified, committed, and delivered on Ethereum, resulting in the release of 116,500 rsETH from the adapter. The adapter balance plummeted from 116,723 rsETH to just 223 rsETH in a single block. Following the minting, the stolen rsETH was funneled through one intake wallet to seven different branch addresses, with approximately 89,567 rsETH being deposited into Aave V3 markets on Ethereum and Arbitrum as collateral.

With these positions, the attacker borrowed around 82,650 WETH and 821 wstETH, maintaining health factors between 1.01 and 1.03. At the time of the report's publication, all seven attacker addresses remained active on Aave, although Aave’s own smart contracts were confirmed to be uncompromised. The protocol logic, including supply, repayment, and liquidation mechanics, continued to function normally throughout the event.

In response to the exploit, the Protocol Guardian initiated measures to mitigate the situation by freezing all rsETH and wrsETH reserves across all Aave V3 deployments at around 19:00 UTC on the same day. This action effectively set the loan-to-value (LTV) ratio to zero, disabling new supply and borrowing while still permitting existing positions to be repaid or liquidated. In total, eleven markets across Ethereum, Arbitrum, Avalanche, Base, Ink, Linea, Mantle, MegaETH, Plasma, and Zksync were impacted.

On April 19, adjustments to the WETH interest rate models were made, particularly on Arbitrum, Base, Mantle, and Linea. The Risk Steward reduced Slope 2 to 1.50 percent and cut the borrow rate from between 8.5 and 10.5 percent down to 3.0 percent APR at 100 percent utilization. A corresponding adjustment was also implemented on Core on April 20, with Slope 1 set to 2 percent and Slope 2 to 3 percent, optimizing utilization at 94 percent. By April 20, the Protocol Guardian further froze WETH on Core, Prime, Arbitrum, Base, Mantle, and Linea to prevent new borrowing and curb potential stress from spreading to stablecoin reserves.

Llamarisk laid out two scenarios regarding how Kelp's loss allocation could ultimately determine the protocol's final exposure. Scenario 1 assumes a uniform socialization of the 112,204 unbacked rsETH across all rsETH supply, resulting in a 15.12 percent depeg and an estimated $123.7 million in bad debt. This would mean that Ethereum Core would absorb $91.8 million in absolute terms, while Mantle would face a 9.54 percent WETH reserve shortfall. In contrast, Scenario 2 treats the loss as isolated to Layer 2 rsETH, applying a 73.54 percent haircut to collateral on remote chains while keeping Ethereum mainnet rsETH intact. This scenario results in an estimated $230.1 million in bad debt concentrated primarily on Mantle at a 71.45 percent WETH shortfall and Arbitrum at 26.67 percent.

As of April 20, 2026, the adapter balance was reported at 40,373 rsETH, the only confirmed backing for all remote-chain rsETH across every Layer 2 path, against total remote claims of 152,577 rsETH. Kelp has yet to disclose how recovered funds will be allocated. Meanwhile, the Aave DAO treasury holds an impressive $181 million in assets, which includes $62 million in Ethereum-correlated holdings, $54 million in AAVE, and $52 million in stablecoins. The DAO generated $145 million in revenue during 2025 and $38 million year-to-date in 2026. Llamarisk has also confirmed that several indicative commitments from ecosystem participants are already in place to address potential bad-debt scenarios.

Currently, WETH reserves on Ethereum, Arbitrum, Base, Linea, and Mantle are operating at 100 percent utilization with idle balances falling below $20 on every chain. This high level of utilization complicates liquidations, as liquidators receive aWETH instead of underlying WETH. Llamarisk flagged Base and Arbitrum as being the least buffered markets, with initial liquidations triggered by WETH price drops of 0.77 percent and 1.77 percent, respectively, due to health factors running around 1.03.

Given the precarious situation, Llamarisk recommended an immediate pause of the WETH Umbrella staking module under Scenario 1. As of the report's publication, 18,922 of 23,507 staked aWETH had entered the unstaking cooldown, blocking deposits, withdrawals, transfers, and slashing while still allowing rewards distribution to continue. The remaining four rsETH-listed markets—Ethereum Lido, MegaETH, Plasma, and Zksync—carry trivial balances and no bad debt, while twelve additional Aave V3 markets that do not list rsETH remain unaffected.