AAVE V3's Wrapped Ether (WETH) reserve is incurring bad debt after an attacker leveraged KelpDAO's rsETH liquid reStaking Token as collateral to borrow on the lending platform.
Solidity programmer and 0xQuit auditor warned on X, reminding depositors that the WETH pool is now experiencing serious problems and withdrawals can only be made partially after AAVE 's Umbrella reserve fund has covered the losses.
The way rsETH was drained created bad debt on AAVE.
The attack began when the attackers transferred funds into the wallet via Tornado Cash. Approximately 116,500 rsETH were withdrawn from KelpDAO , totaling over $290 million.
The attacker then used the stolen rsETH as collateral on AAVE V3 and borrowed a large amount of WETH.
When the rsETH is depleted and no longer serves as collateral, these mortgage positions become liquidated. This leaves AAVE with an obligation to repay WETH that cannot be recovered through normal liquidation methods.
“I wish I had better news, but it looks like the WETH pool on AAVE is truly broken. If you can still withdraw, do so, but it’s likely too late,” warned 0xQuit, a Solidity developer and security auditor.
Currently, rsETH markets on AAVE V3 and AAVE V4 are frozen. AAVE also confirmed that the contracts were not hacked and the issue only involved rsETH.
“The freezing of the rsETH market will prevent new deposits or loans secured by rsETH, providing time to assess the situation. We are reviewing rsETH-related loans on AAVE that arose after the incident… if the protocol incurs further bad debt as a result, assets from Umbrella will be used to offset the losses,” AAVE announced .
How will Umbrella affect the sender WETH?
AAVE's Umbrella system, launching in late 2025 to replace the old Safety Module, is designed to provide protection in situations like this incident.
Those who have Staking aWETH in the Umbrella vault may have their stakes automatically reduced to cover the deficit.
Once the downsizing process is complete, the remaining WETH suppliers will be able to withdraw a portion of their funds from the pool.
However, the possibility of recovering the entire amount is uncertain, and the depositor may experience asset "haircutting" (reduction in the balance).
This also marks the first time the Umbrella system has been used in practice to automatically handle such a large amount of bad debt. The incident has also raised new concerns about the risks of approving whitelisting for liquid reStaking Token as collateral on lending platforms.
Meanwhile, the Upshift team – a non-custodial vault platform supporting the management of Tokenize assets – also reassured users that they have absolutely no contact with rsETH.
“We are in contact with KelpDAO regarding a potential issue related to rsETH. For safety reasons, the Kelp team has temporarily suspended deposits and withdrawals from the High Growth ETH and Kelp Gain vaults while we investigate. The Upshift USDC, Core USDC , and EarnAUSD vaults are currently not exposed to rsETH. We will provide updates as we receive further information from Kelp,” Upshift announced .
