Aave WETH Suppliers Urged to Withdraw After KelpDAO rsETH Exploit
Aave V3’s Wrapped Ether (WETH) reserve is carrying dangerous debt after attackers exploited KelpDAO’s rsETH liquid restaking token and used it as collateral to borrow towards the lending protocol.
Solidity developer and auditor 0xQuit flagged the state of affairs on X, warning depositors that the WETH pool is successfully impaired and that partial withdrawals could solely turn out to be doable after Aave’s Umbrella backstop settles the deficit.
How Drained rsETH Created Bad Debt on Aave
The exploit began with an attacker funding wallets via Tornado Cash. Approximately 116,500 rsETH was drained from KelpDAO, totaling over $290 million.
The attacker then provided the stolen rsETH as collateral on Aave V3 and borrowed a big quantity of WETH towards it.
Because the rsETH grew to become unbacked after the drain, the ensuing positions are successfully unliquidatable. This left Aave holding WETH obligations it can’t get better via regular liquidation.
“Wish I had higher information however appears like WETH on aave is fucked. Withdraw should you can however doubtless too late,” warned 0xQuit, Solidity developer and auditor.
What Umbrella Means for WETH Depositors
Aave’s Umbrella system, which changed the legacy Safety Module in late 2025, is designed for precisely this situation.
Users who staked aWETH within the Umbrella vault face computerized slashing to cowl the deficit.
Once the slashing cycle completes, remaining WETH suppliers ought to regain partial withdrawal entry.
However, a full restoration is just not assured, and depositors may face a haircut on their positions.
The incident marks the primary main real-world check of Umbrella’s automated bad debt coverage. It additionally raises contemporary questions concerning the dangers of whitelisting liquid restaking tokens as collateral on lending protocols.
Meanwhile, the Upshift group, providing non-custodial vaults for managing tokenized property, have assured customers that they don’t have any publicity to rsETH.
“We are in contact with KelpDAO a couple of potential exploit of rsETH. As a precaution, the Kelp group have determined to briefly pause deposits and withdrawals to the High Growth ETH and Kelp Gain vaults whereas their investigations happen. Upshift USDC, Core USDC and EarnAUSD vaults have zero publicity to rsETH. We will present updates as we obtain them from the Kelp group,” wrote Upshift.
The submit Aave WETH Suppliers Urged to Withdraw After KelpDAO rsETH Exploit appeared first on BeInCrypto.
