Following the security breach on KelpDAO’s rsETH bridge, Aave has released an extensive status update. The protocol describes the technical background of the incident, its impact on Aave and possible damage scenarios in the new report.
According to the statement, service providers associated with the Aave DAO are currently evaluating potential “bad debt” scenarios that may arise in the protocol and are working in coordination with ecosystem participants to close this gap.
According to the report, the attack took place on April 18, 2026, on Kelp’s LayerZero V2-based Unichain-Ethereum rsETH route. The attacker allegedly extracted 116,500 rsETH from the Ethereum adapter using a spoofed verification package, then distributed these assets to multiple addresses, collateralized a portion on Aave V3, and borrowed WETH and wstETH. According to Aave data, the attacker used a total of 89,567 rsETH as collateral on Aave, while borrowing approximately 82,650 WETH and 821 wstETH. A significant portion of these positions were opened on the Ethereum and Arbitrum networks.
Aave specifically stated that the incident did not arise from its own smart contracts. According to the protocol, the security vulnerability stemmed entirely from the external infrastructure to which the rsETH asset was tied, and Aave’s contracts, oracle system, and liquidation mechanisms functioned as designed throughout the process. Following the detection of the incident, rSETH and wrsETH reserves were frozen for all Aave V3 distributions, the loan-to-value ratio in the relevant markets was reduced to zero, and new issuance or lending transactions were halted. In addition, the WETH interest rate model was updated in several chains and further freezing measures were implemented in the WETH markets to prevent the spread of new loans.
Aave presented two scenarios for compensation for damage incurred
The report examined two main scenarios for potential losses. In the first scenario, if the losses were spread evenly across the entire rsETH supply, the total bad debt on Aave could reach approximately $123.7 million. In this case, the largest absolute loss would be seen on Ethereum Core, while the heaviest proportional impact would occur on the Mantle chain. The second scenario assumes that losses are only reflected in rSETH assets at L2. In this case, the estimate of total bad debt increases to $230.1 million. According to the report, in this scenario the greatest pressure would be on WETH reserves at Mantle, Arbitrum and Base.
According to data shared by Aave, the DAO Treasury held a total of $181 million in assets as of April 20, 2026. Of these assets, $62 million consisted of Ethereum-related products, $54 million in AAVE tokens, and $52 million in stablecoins. Furthermore, the protocol reported that it generated $145 million in revenue in 2025, and achieved $38 million in revenue and $16 million in net profit since the beginning of 2026. Aave stated that it is not only dependent on the financial resources, but also on support pledges from representatives of the ecosystem.
Related news Allegations of Major Manipulation in an Altcoin – Crypto Detective ZachXBT Speaks Out
Another notable point in the report was the liquidity crisis in the WETH markets. It was stated that WETH reserves on Ethereum, Arbitrum, Base, Linea and Mantle have currently reached 100% utilization. This makes it more difficult for liquidity providers to access free WETH during liquidation processes, increasing pressure on the system. Aave said that while the system will continue to function overall, external decisions, especially regarding how the rsETH losses will be distributed, will determine the final outcome.
What can you expect from the umbrella mechanism?
In the report published by Aave, the “Umbrella” (also known as the security/insurance module) stands out as one of the crucial topics in the context of the rsETH crisis. This mechanism functions as a security layer aimed at protecting certain reserves by activating in cases of “bad debts” that may arise in the protocol.
According to details shared by Aave, the Umbrella module acts as a buffer specifically for WETH reserves on the Ethereum mainnet (Core). Normally, this module works through a pool created by staking certain assets, and when the protocol suffers losses, the assets in this pool can be used to cover part of the shortfall through “slashing” (deductions).
However, in the context of the current rsETH crisis, Aave has made a notable suggestion regarding the Umbrella module: suspend it temporarily. The main reason behind this is to prevent premature and uncontrolled activation of the module in a potential worst-case scenario (especially if the losses spread across the entire system), thus preventing rapid depletion of the deployed assets.
According to the report, a significant portion of the approximately 23,500 WETH currently deployed under Umbrella are in the ‘non-deployment pending’ phase. This indicates that investors are preparing to withdraw their money, which poses a potential risk of a bank run.
On the other hand, it is stated that in the second scenario (where losses are limited only to rsETH on L2 networks) the umbrella module may not need to be activated. This is because this module only covers the reserves on the Ethereum mainnet and losses from L2 networks are beyond the scope of this security mechanism.
In conclusion, while Umbrella is seen as an important ‘last line of defense’ that Aave can call upon in times of crisis, in the current situation, keeping it on standby in a controlled manner is considered a safer strategy than deploying it directly.
*This is not investment advice.