Aave’s total value locked has yet to recover from the April 18 KelpDAO exploit, with roughly $14.9 billion in assets now held in the protocol compared with $26.4 billion just before the incident. That leaves the lending platform down 43% since the attack and about 67% below its October 2025 high of $45.9 billion.

Aave itself was not directly hacked, but its exposure to KelpDAO-linked collateral left it facing a major hit after stolen rsETH was used to borrow funds. The episode has remained a significant overhang for one of the largest lending and borrowing protocols in decentralized finance.

How the losses hit Aave

According to the source report, North Korean hackers looted KelpDAO in mid-April. Because Aave accepted KelpDAO tokens as collateral for loans, the stolen assets were then used to extract value from the protocol, leaving Aave with a nine-figure loss.

The short-form account of the incident said attackers used stolen rsETH as collateral to borrow ETH, contributing to an estimated $246 million in combined bad debt across Aave and Compound. Aave later said in its own report that its contracts, oracles, and liquidation mechanics functioned as designed, even though the attackers were still able to withdraw funds using what the report described as phony collateral.

A sharp drop in deposits and available liquidity

The effect on Aave was immediate. Within two days of the hack, deposits on the protocol had fallen by more than $8 billion, and Aave’s stablecoin pools reached 100% utilization. That meant billions of dollars in crypto were effectively stuck, with no remaining room for additional stablecoin withdrawals.

The protocol’s token also fell sharply in the aftermath. Aave dropped about 20% over the day after the theft, sliding from around $115 to below $92. It now trades near $89, still slightly under its level before the exploit.

Why the TVL decline matters

Aave is a non-custodial lending application, and its TVL is more than a headline metric. The figure reflects the value of deposits available to support borrowing activity across the platform.

A smaller pool of assets means less inventory for borrowers and can also bring greater volatility. The report notes that Aave ended 2025 with $55 billion in TVL, accounting for more than half of the total value locked in the DeFi lending sector at the time, underscoring why a prolonged contraction at Aave matters beyond a single protocol.

Recovery efforts and what happened next

Aave and related parties moved to stabilize the situation after the exploit. On April 27, Aave said a new coalition called DeFi United had pledged enough ETH to restore rsETH’s full backing. On May 6, it liquidated the attacker’s positions on Ethereum and Arbitrum, while replacement collateral was added to bridge reserves in stages through late May.

Even so, outflows continued well beyond the initial shock. TVL kept falling into June and eventually bottomed near $11.9 billion before recovering part of the decline. The latest level of about $14.9 billion shows improvement from that low, but it remains far below both the pre-hack balance and the peak reached in October 2025.

Source: protos.com