I’m one of the regular ETH suppliers caught in the KelpDAO rsETH exploit. I want to raise something I haven’t seen discussed clearly yet: the bad debt is denominated in ETH, not dollars. That makes time the enemy.
The attacker borrowed approximately 126,000 ETH using stolen rsETH as collateral. That debt is fixed in ETH terms. Aave’s treasury and Umbrella backstop are denominated in stablecoins and dollars. Every hour ETH price rises, the gap between what the protocol owes suppliers and what it can cover grows wider. At $2,317 the bad debt is ~$290M. At $3,000 it becomes ~$378M. At $4,000 it becomes ~$504M. The treasury doesn’t move with ETH price.
The Umbrella waWETH vault holds approximately $56M. The DAO treasury holds approximately $83M, of which $25M was just committed to Aave Labs. That leaves roughly $114M available against a $290M deficit today. The gap is already ~$176M and it grows with every ETH price tick upward.
I’d like governance to consider an emergency debt facility, borrowing against Aave’s $140M annual protocol revenue from institutional investors or crypto VCs to plug the gap immediately. The protocol has real cashflow that makes this viable. Lock in the liability in dollar terms now before ETH runs further. Repay over 12-18 months from revenue.
Aave has $25B in TVL and is the most trusted lending protocol in DeFi. That reputation is worth protecting, but only if governance acts fast enough. Every day of inaction is a day the hole gets bigger.
Suppliers who did nothing wrong are watching their ETH frozen in a pool at 100% utilization with $0 available liquidity. We deserve a clear resolution plan and a timeline, not silence.
I am a bit more relaxed. Aave holds rsETH as collateral for the wETH that was lent (and might now go missing). The main party that has a problem with the missing USD 300M is the Kelp DAO. Their market cap is at USD 1.2B - so in the worst case you can expect a haircut in rsETH of 25%. That would still be covered by Aaves overcollateralization. You should be fine.
Let’s hope you are right. All I’m looking for at this point is to be able to withdraw the ETH. A delay timer on borrowing exceeding a certain value could have saved our skin.
rseth’s e-mode is 93%, meaning the overcollateralization is only 7% more than the debt. If rseth’s loss is 25%, the 7% overcollateralization cannot cover the 25% loss.
If we impose borrow limit on a wallet address, hackers can bypass this mechanism by using a large number of addresses and small loans. The only way is to impose borrow limit on the asset.For example, only 10 million can be borrow every 8 hours, and this is reset on a rolling basis.
Ok, thank you. Let us see what is relevant in the current case. I guess it remains valid that there is some form of collateral and the main issue was within Kelp DAO’s responsibility. Guess we have to wait and see. Interesting will also be which level of interest rates will be applicable for provided risk/working capital in the future.
Urgent Appeal: Request Vitalik to Lead Coordination and Joint Support from Five Major Institutions to Stabilize Aave Ecosystem
The liquidity strain on Aave caused by the rsETH cross-chain bridge security incident continues to escalate, entering a critical phase of risk spillover. If targeted liquidity support cannot be injected in a timely manner within the next 24 to 48 hours, market panic is highly likely to spread and amplify further. The impact will go far beyond the scope of bad debt for a single protocol, and may even pose a systemic shock to the entire Ethereum DeFi ecosystem.
We hereby formally submit a request for urgent collaborative support to Tether, Circle, Binance, OKX and Ripple, and sincerely ask Vitalik to lead overall coordination to establish a joint response mechanism as soon as possible:
1. Jointly provide liquidity support from the five parties to targetedly fund the relevant capital gap, effectively ease the current run pressure, and quickly restore market confidence.
2. Accelerate the formulation and implementation of practical and feasible collaborative plans, promote execution with maximum efficiency, and contain risk spread to the greatest extent.
3. Jointly safeguard the underlying stability of the Ethereum DeFi ecosystem and block the possibility of risk transmission to stablecoins and the overall market liquidity system.
The situation is pressing. Every minute of delay may aggravate risk spread. We urge all parties to proceed from the overall stability of the industry, respond promptly, make decisive decisions, and work together to stabilize the market foundation.
Aren’t you all very supportive of AAVE Labs’ wise decision? Now is the time to support them. I suggest you sell your house to cover your losses and continue to trust them.
One, this really isn’t the time for more infighting.
Two, rsETH was put in as collateral before Labs truly took over the DAO, so it is senseless to attack them.
Three, no one expected this to happen, this is what’s commonly referred to as a “black swan event” and is AAVE experiencing what every other lending protocol has experienced the last 6 months with Stream and Resolv.
It reminds me of harmony for which AAVE did absolutely NOTHING.
And same story: they let enable usdt or usdc lending. New comers will come and see “wow 15% i will lend” and ended up becoming exit liquidity for others. Exactly what happened on harmon AAVE showing APY like 50% on ONE for at least a month. Many people got tricked.
Arbitrum ETH pool should be unfrozen immediately. $18M bad debt against $335M in locked supplier funds is indefensible.
Aave has officially confirmed that rsETH on Ethereum mainnet is fully backed. This changes everything. The bulk of what initially looked like $290M in bad debt is not bad debt at all. Mainnet positions are liquidatable through normal mechanisms. What remains is a contained L2 problem.
According to CoinGecko’s analysis, the attacker borrowed approximately $18M on Arbitrum. The total Arbitrum ETH pool holds $335.68M in supplier funds. That means the bad debt represents roughly 5.4% of the pool and Aave’s treasury alone sits at $83M, nearly 5x the entire Arbitrum bad debt.
Every day the Arbitrum pool remains frozen, legitimate borrowers paying 11% APY are incentivized to repay, meaning liquidity is naturally recovering anyway. The freeze is actively hurting suppliers while providing zero additional protection against a bad debt that is already capped, quantified, and affordable.
After this many hours Aave should:
Publish full chain by chain bad debt breakdown publicly today
Confirm mainnet positions are being liquidated normally given rsETH is fully backed
Cover the $18M Arbitrum bad debt from the DAO treasury immediately
Unfreeze the Arbitrum ETH pool as a separate and independent action from mainnet
Provide a concrete timeline for full resolution across all affected chains
Commit to isolated risk pools for exotic collateral in V4 so this never happens to plain ETH suppliers again
Covering $18M to make Arbitrum suppliers whole is not a question of affordability. It is a question of whether governance moves fast enough to deserve that trust or they will treat it like Harmony and fuck all of us with silence.
Every hour of unnecessary delay is reputational damage.