Aave’s deposit base has only partly recovered five months after the April exploit tied to Kelp DAO’s rsETH bridge. As of this week, the lending protocol held about $18.1 billion in deposits, still roughly 31% below the $26.1 billion on the platform the day before the attack.

The episode did not stem from a flaw in Aave’s lending contracts, according to the incident details cited in the source report. Instead, the losses were tied to collateral that entered Aave after a failure elsewhere in the stack: the bridge and data infrastructure behind rsETH, a token representing a claim on staked ether.

How the exploit reached Aave

The attack centered on Kelp’s cross-chain bridge rather than Aave’s core code. According to the report, corrupted data feeds and a fake message pushed through the bridge led to the release of 116,500 rsETH worth about $292 million without backing, an amount close to 18% of the token’s supply.

Security firm Halborn traced the theft to a single-verifier setup and hijacked data nodes, and linked the activity to North Korea’s Lazarus Group. The source report describes rsETH holders as holding a claim on staked ether, with that claim itself depending on the bridge mechanism that was exploited.

Borrowing against unbacked collateral

Once the unbacked tokens were created, they moved into lending markets. Attackers supplied 89,567 rsETH on Aave and borrowed roughly $193 million against it before the position was stopped.

Aave said it froze rsETH across 11 markets within an hour of detecting the issue. Two days later it also froze WETH, and the platform warned WETH suppliers to withdraw that same evening, hours before those pools reached full utilization.

Loss estimates and recovery efforts

Aave’s incident report put the bad debt at $123.7 million if losses were distributed evenly. If the bridged rsETH exposure was isolated, the estimate rose to $230.1 million.

A coalition-funded recovery effort by other protocols gathered about 69,570 ETH in pledges against a 75,081 ETH shortfall, according to the source article. Arbitrum’s Security Council froze 30,765 ETH of the proceeds, and Arbitrum’s DAO released that amount to Aave in June.

Deposits recover, but not fully

The figures suggest that user confidence has returned only gradually. Aave held $12.5 billion at the end of June, and that total has since climbed to $18.1 billion, but it remains around $8 billion below the level seen before the Kelp-related exploit.

The source article also noted that AAVE was trading near $124, down 3.8% on the day at the time of writing. That market move was reported alongside the broader observation that depositors appear to have been slower to return than the protocol’s balance sheet was to stabilize.

What remains unresolved

The report says a US court order sought by creditors holding judgments against North Korea still hangs over the frozen funds. That leaves a layer of uncertainty around money tied to the recovery process even after part of the proceeds was released in June.

The episode also highlighted a wider issue for lending markets that accept wrapped or receipt-based assets as collateral. In this case, the next confirmed step is not a new technical fix on Aave itself, but the continued handling of the frozen funds and any further resolution of the legal claims attached to them.

Source: beincrypto.com