Aave Estimates $124M–$230M in Bad Debt Exposure From Kelp Exploit

On Monday, Aave service providers released an incident report that quantifies the protocol's exposure to the Kelp DAO rsETH bridge exploit that occurred on April 18. The report outlines two bad-debt scenarios, ranging from approximately $123.7 million to $230.1 million. It recommends an immediate pause of the protocol's Umbrella safety module. The report, posted to the Aave governance forum, states that 89,567 of the 116,500 rsETH stolen from Kelp's LayerZero bridge were deposited into seven attacker-controlled wallets on Aave. These positions borrowed 82,650 WETH (roughly $190.86 million) and 821 wstETH (roughly $2.33 million). The single largest position was on Aave's Ethereum Core market. One wallet supplied 53,000 rsETH and borrowed 52,460 WETH, which amounts to approximately $121 million. The remaining positions were spread across Aave's Arbitrum deployment. All attacker positions currently have health factors between 1.01 and 1.03. This means the positions are barely above liquidation thresholds and present significant risk to the protocol if market conditions shift even slightly. I note that the dispute between LayerZero and Kelp DAO regarding responsibility for the bridge configuration compromise remains unresolved. The final bad-debt figure depends on how Kelp DAO chooses to allocate losses across affected parties.