Aave TVL Slides 35% to $17.56B After $300M KelpDAO Exploit Triggers $9B Outflow

A major exploit at DeFi project KelpDAO has rippled across the sector, sparking one of the largest withdrawal waves in decentralized finance and driving more than $9 billion out of lending protocol Aave. According to details of the incident, attackers manipulated Kelp's cross-chain bridge, which sent 116,500 rsETH—valued at nearly $300 million—to a wallet controlled by the hackers. After the breach, roughly $200 million of the stolen tokens was deposited into Aave and posted as collateral, allowing the attackers to borrow other cryptoassets. Market participants focused less on the initial theft and more on the downstream risk to Aave. If the stolen collateral were to collapse in value or be frozen and rendered unusable, Aave could be left with loans that are effectively undercollateralized. As an automated protocol, Aave has limited ability to intervene in real time, amplifying concerns. Following the episode, Aave's Total Value Locked (TVL) fell to $17.56 billion, a decline of about 35%. The AAVE token also dropped roughly 20% over the past two days and was trading near $90 at the time of writing. DeFi Remains Vulnerable Analysts have long warned that DeFi's rapid growth can outpace security hardening. While the sector enables lending, borrowing, and yield generation without intermediaries, it also carries risks tied to smart contracts, oracle manipulation, and collateral volatility. The KelpDAO exploit adds to a growing list of high-profile incidents. A few weeks earlier, decentralized exchange Drift was hit by a $285 million exploit, fueling debate around stablecoin issuers such as Circle after criticism that stolen USDC was not frozen quickly enough. In 2026, Solana-based Step Finance shut down a month after a late-January hack that saw about 261,000 SOL stolen, worth roughly $27 million at the time. Related: Nine DeFi Protocols Frozen After $293 Million KelpDAO rsETH Exploit Disclaimer: This article is for informational and educational purposes only and does not constitute financial advice. Coin Edition is not responsible for losses arising from the use of any content, products, or services mentioned. Readers should exercise caution before taking any action related to the company.