From 45.8 billion to 35.7 billion, tens of billions of funds fled Aave! Is the DeFi lending leader about to collapse? An in-depth analysis of the rsETH attack!

Оригинальный автор：加密播客

Первоисточник：https://www.youtube.com/embed/uXU1EDWDKLE

In the early morning of April 18, 2026, KelpDAO's LayerZero cross-chain bridge was attacked. The attacker exploited message layer configuration flaws to illegally mint approximately 116,500 rsETH (worth approximately US$292 million), deposited these counterfeit tokens in Aave V3 as collateral, borrowed a large amount of WETH, and then sold part of the rsETH directly. KelpDAO urgently suspended the multi-signature contract 46 minutes after the attack, and froze the relevant liquidity pools and tokens, preventing further losses. However, the damage caused was irreversible - the attacker obtained a total of approximately 106,466 ETH, worth approximately US$2.5 billion. The crux of the problem is that after KelpDAO suspended the rsETH contract, rsETH as Aave's collateral became unable to be traded and priced, resulting in the related borrowing positions not being effectively liquidated, and the losses were essentially transferred to Aave's WETH reserves. Market estimates suggest the size of bad debts Aave faces is about $177 million to $200 million, depending on the resolution. DefiLlama founder 0xngmi gave three possible disposal paths: First, socialized loss sharing, users bear about 18.5% of the impairment, and there is still a gap of about US$76 million after insurance and treasury coverage; second, "Rug Pull" processing of rsETH holders on the second-tier network, which may cause bad debts of US$341 million; third, return assets according to the pre-attack snapshot, and there is still a loss of about US$91 million after insurance coverage. Aave's security module holds approximately $300 million in AAVE tokens, which can be used as a last resort, but using it will directly reduce the tokens, which may trigger selling pressure on governance tokens and consensus dilution. Panic quickly spread and funds continued to flow out of Aave. The initial outflow scale was approximately US$5.4 billion to US$6.6 billion. By April 20, the cumulative outflow had reached US$10.1 billion, and total deposits plummeted from US$45.8 billion to US$35.7 billion, of which stablecoin outflows of US$4.5 billion. On April 19 alone, approximately US$6.6 billion was withdrawn in a single day. This speed is extremely rare in the history of DeFi lending. As a result, the stablecoin liquidity pool was extremely tight. The deposit rates of USDT and USDC quickly climbed to 13.4% after the incident and remained there for more than 24 hours. The borrowing rate once soared to 15%, which was equivalent to the protocol issuing an alarm of severe liquidity depletion - the stablecoin capital available for lending was almost exhausted, and it could only rely on ultra-high interest rates to attract new deposits. The AAVE token fell more than 18% in 24 hours, with the protocol TVL falling from approximately $26.396 billion to approximately $19.8 billion. The decline in token prices and the pressure of bad debts form a negative cycle: if the security module is forced to be used, the reduction of AAVE tokens will further suppress prices and weaken protection capabilities. This crisis is not limited to Aave. All leading lending protocols in the industry experienced net outflows of funds. Morpho had an outflow of US$716 million, Sky had an outflow of US$272 million, JupLend had an outflow of US$76 million, and the entire DeFi TVL evaporated by nearly US$10 billion. The failure of a critical node triggered a crisis of trust in the robustness of the entire system. At the same time, funds began to migrate to other protocols. Spark became the biggest winner, with its ETH deposit interest rate soaring to 130% and still remaining around 18% 48 hours after the incident. Spark had removed rsETH from the collateral list as early as January and maintained a high maximum borrowing rate. This forward-looking risk management made it "anti-fragile" in this crisis. Well-known investor Justin Sun also urgently withdrew 65,584 ETH (approximately $154 million) from Aave and deposited most of it in Spark, further amplifying the benefits of competitors. Looking at a deeper level, this incident exposed two structural vulnerabilities in DeFi: the security of cross-chain bridges and the risk transmission mechanism of Liquidity Re-pledge Tokens (LRT). Cross-chain bridges have been targeted by attacks many times, and this time the LayerZero message layer configuration flaw once again verified this risk exposure. As LRT is a complex multi-layered derivative, any loopholes in the underlying re-pledge strategy or oracle pricing failure will be amplified into a systemic crisis through the lending agreement. Although the unified liquidity model adopted by Aave improves capital efficiency, it also brings about a risk concentration effect - when a risk signal occurs, the best choice for every rational user is to exit immediately, which precisely accelerates the outbreak of a liquidity crisis. In addition, AI-driven attacks are accelerating, with research showing that the ability to exploit vulnerabilities is doubling approximately every 1.3 months, and AI security agents are already better than standard code agents at discovering smart contract vulnerabilities, which means defense technology must keep up as soon as possible. For investors, in the short term, they need to pay attention to the choice of bad debt disposal plan, how to use the Umbrella security module, Aave's market utilization indicators, and the price trend of AAVE tokens. In the medium term, the risk premium of DeFi lending protocols will face repricing, collateral review standards will be tightened, audit requirements for cross-chain bridges and re-pledge projects will be increased, user demand for isolated lending and modular architecture may increase, and the design of protocol insurance and risk reserves will also become a new competitive dimension. Establishing a systematic risk management framework—including protocol dependency graphs, collateral quality assessments, emergency exit plans, and multi-protocol decentralized configuration—will be a required course for DeFi participants. This incident was an extreme stress test on the bottom layer of DeFi. Aave's core smart contract has not been directly breached, and the security module is undergoing actual combat testing, but it will take time to repair trust. As the founder of DefiLlama said, "No one wins in this kind of incident. It will only shrink the 'cake' of the entire industry and everyone will suffer." The future DeFi ecosystem will find a new balance between security and efficiency.