Kelp rsETH Hack: Llamarisk Details Aave V3 Bad Debt, Multi-Chain Freezes

Llamarisk and Aave service providers published an incident report on the Kelp rsETH hack, saying a bridge exploit targeted KelpDAO’s Layerzero V2 rsETH route on April 18, 2026. The attacker extracted 116,500 rsETH from an Ethereum OFT adapter without burning tokens on the source chain, causing the adapter balance to drop from 116,723 rsETH to 223 rsETH in one block. After the Kelp rsETH hack, Aave V3 markets were exposed to estimated bad debt of $123.7M–$230.1M across 7 affected markets, depending on how Kelp socializes losses. Of the stolen 116,500 rsETH, 89,567 were deposited as collateral on Ethereum and Arbitrum Aave V3, enabling borrowing of about 82,650 WETH and 821 wstETH, with reported health factors around 1.01–1.03. All seven attacker addresses remained active at publication. Risk response included Protocol Guardian freezes of rsETH and wrsETH reserves across Aave V3 deployments (~19:00 UTC, April 18), setting LTV to zero and disabling new supply/borrowing while keeping repayments and liquidations enabled. Across multiple chains (Ethereum, Arbitrum, Avalanche, Base, Ink, Linea, Mantle, MegaETH, Plasma, Zksync), LTV was effectively contained. The report also notes interest-rate model adjustments on Arbitrum/Base/Mantle/Linea (~April 19) and Core (~April 20), plus additional WETH freezes to limit contagion into stablecoin reserves. Aave DAO treasury was cited at $181M as of April 20, and indicative recovery commitments were reported as already in place. Llamarisk recommended an immediate pause of the WETH Umbrella staking module under one loss scenario.