Aave confirms its own smart contracts were not exploited; the rsETH issue led to the freeze, removal of borrowing power against rsETH, and setting loan-to-value ratios to zero for affected deployments.

Withdrawal dynamics worsened as fear of debt spillover sparked outflows from Aave’s ETH and WETH pools, impacting related stablecoin pools due to liquidity strain, even though USDC/USDT reserves weren’t directly exposed to rsETH.

Aave’s next steps include completing a bad debt review, issuing a formal Umbrella resolution, and monitoring whether outflows stabilize as markets absorb the incident’s full impact.

Aave has frozen rsETH markets on V3 and V4 to stop further deposits and borrowing against rsETH collateral, and the team is reviewing borrows that occurred after the exploit, with Umbrella assets potentially used to offset any deficit.

The attack tied to 116,500 rsETH drained from KelpDAO enabled the attacker to post rsETH as collateral on Aave V3 and borrow WETH, triggering a broader bad debt scenario.

As of the briefing, no new exploits were reported; ETH pool utilization remains high and full withdrawal access depends on Umbrella’s resolution or market stabilization.

rsETH became unbacked after the drain, leaving positions effectively unliquidatable and creating WETH obligations that cannot be recovered through standard liquidation.

Founder Stani Kulechov said rsETH is frozen on Aave V3 and V4 and there will be no further exposure to rsETH, as the protocol isolates the incident while assessing losses.

Umbrella, which replaced the Safety Module, is designed to cover bad debt by slashing staked aWETH; after slashing, remaining WETH suppliers may regain partial withdrawal access, though a full recovery isn’t guaranteed and deposits could face a haircut.

The incident tests Umbrella’s automated bad debt coverage and raises questions about risks of whitelisting liquid restaking tokens as collateral on lending protocols.

Aave’s WETH pool hit 100% utilization with about $5.4 billion in outflows, reducing total value locked by roughly 24%, and the AAVE token fell sharply.

KelpDAO paused rsETH contracts; as a result, collateral backing those borrows became worthless and liquidation was blocked, with potential bad debt spreading to other platforms like Compound and Euler.