rsETH incident — 2026-04-18

Am I the only person who thinks it is morally questionable for Marc Zeller, who was, as I understand, co-responsible for V3 and until yesterday even ran a related incentive program with ACI, to be the first to recommend a bankrun publicly? Luckily, I do not believe the damage for Aave will be that great, but I think it is good that Aave Labs take more control given such actions. Warm regards, Saemi

4 Likes

This is why segregating risk along different spokes with smaller limits with V4 is a far superior model than the pool model of V3. It is essentially a middle ground between a Morpho isolated market and the all in one everything is shared with each other mixed market of AAVE/Spark.

2 Likes

Marc has been plainly acting in opposition to AAVE’s best interests ever since he lost the war over the DAO to Labs. I have my thoughts about the centralizing impact of Labs on the DAO, but regardless this behavior isn’t really anything new since it has been going on for months now.

It really is a blessing that TokenLogic will be transitioning sGHO to a more stable and standardized ERC4626 contract rather than letting ACI control the distribution of rewards, at this point I’m not convinced they are good faith actors.

3 Likes

seems morph’s reserve also run out of liquidity https://app.morpho.org/ethereum/market/0xba761af4134efb0855adfba638945f454f0a704af11fc93439e20c7c5ebab942/rseth-weth
They might be lucky because their rsETH liquidity is too low to be exploited by hacker.

back to that time, if user don’t withdraw, attacker might drain again.

It do give lessons to future V4 risk configuration. AAVE will rise again for sure.

1 Like

Urgent Appeal: Ask Vitalik to Lead and Launch Immediate Rescue for Aave with Tether, Circle, Binance, OKX and Ripple

Aave is facing a liquidity crisis triggered by the rsETH cross-chain bridge attack, which has entered a critical window for potential contagion. Without substantial rescue funding within 24–48 hours, panic will spread further. The consequences will extend far beyond the current bad debt and could even trigger systemic risk across the entire DeFi ecosystem.

We hereby issue an urgent rescue request to the five institutions: Tether, Circle, Binance, OKX, and Ripple. We sincerely ask Vitalik to lead the coordination and swiftly launch a joint rescue mechanism:

1. The five institutions jointly provide capital to inject short-term liquidity into Aave, prioritizing covering the bad debt gap, stopping the bank run, and stabilizing market confidence.

2. Finalize a unified rescue plan as soon as possible and implement it with maximum speed to prevent further escalation of the crisis.

3. Safeguard the foundation of Ethereum DeFi and prevent risk contagion to stablecoins and the entire crypto market liquidity system.

Time is extremely critical. Every hour of delay increases the risk of contagion. We urge all parties to act in the overall interest of the industry, take immediate action, make quick decisions, and jointly stabilize the market.

This is a first going through something like this. My lending network is ETH on Base, are we able to withdraw if we’d like to?

The WETH interest rate model has been adjusted via the Risk Steward across Arbitrum, Base, Mantle, and Linea, reducing slope2 to 1.50% and bringing the borrow rate at 100% utilization down from 8.5–10.5% to 3.0% APR. This change ensures borrow rates remain sustainable under current market conditions, keeping leveraged positions viable and preserving reserve stability across affected markets.

2 Likes

That would make available liquidity even more difficult to get.

5 Likes

Have we lost all the funds we deposited in an Aave protocol?

Hi everyone,

I’m new here and I’ve been following the work of LlamaRisk and the other teams with great respect. I can see how much effort is being put into keeping the system stable. Thank you for that!

However, one thing keeps bothering me when I read questions from users like Flyn29 (“Have we lost all our funds?”). It breaks my heart to see this level of uncertainty. My simple “street logic” tells me: when a partner is in trouble, you don’t leave them alone in a burning building and discuss interest rates (like the 3% proposal). You go in, take them by the hand, and help them manage the assets—the 533,500 ETH—together until everything is fixed.

ApuMallku already suggested that low interest rates make it harder to attract new liquidity. Wouldn’t it be a sign of real strength and care if Aave took over the management of Kelp? Not to punish anyone, but to be able to tell users like Flyn29 clearly: “We are in control now, your funds are safe with us.”

I haven’t found an answer on X, but I believe this forum is the right place to talk about active help and taking over responsibility. What are your thoughts?

6 Likes

I can sell my arbitrum and base liquidity tokens on uniswap for quite a steep discount. Greater than 50% loss. Do people think it’s better to wait and hope for some kind of recovery or is a greater than 50% loss better than a 100% loss.

There won’t be any loss, good things come to those who wait.

5 Likes

I’d strongly suggest that the AAVE risk assessment changes slightly to account for what is most probably an infrastructure related incident for OFTs

There should be a stronger requirement that OFTs utilize at least 2 DVNs and immediately halt markets that don’t meet that threshold. I’d even argue if you’re going to onboard an asset that’s an OFT AAVE should probably run one of the DVNs

1 Like

I’ve been with Aave since the LEND token and staked AAVE in the Safety Module for years. When Umbrella launched, I migrated to stkWETH because I believed in the upgrade. I’m now facing significant losses from a bridge exploit in a protocol I never interacted with.

I accepted slashing risk. But I staked in Umbrella because I trusted the Aave protocol — the smart contracts, the liquidation engine, the risk parameters. What I did not believe I was doing was underwriting the bridge security of KelpDAO or the DVN configuration choices of LayerZero OFTs. The failure here was not in Aave’s contracts. It was in the listing decision and the supply caps that allowed this scale of exposure.

The documentation cited $400 in deficits against $9.5B in borrows during v3.3’s first month. At 9% APY, the yield I earned doesn’t cover a fraction of what’s being slashed. That risk/reward was never calibrated for a $196M external bridge hack.

KelpDAO’s infrastructure failure created this deficit. They need to be at the front of the line for making affected parties whole — through their treasury, their token, or whatever means necessary. Aave governance should be actively pursuing that.

If stakers get wiped out in month two from an external hack, the module will not attract capital again without fundamentally different listing standards and risk parameters.

9 Likes

Let’s get one thing absolutely straight regarding the $196M rsETH bad debt: Umbrella stakers did not sign up to underwrite bridge fraud.
The current narrative pushing for a 100% wipeout of the WETH Umbrella vault relies on a massive, unjustifiable stretch of the insurance mandate. We need to draw a hard line right now between market risk and infrastructure negligence.
If you are an Umbrella staker, an $AAVE token holder, or a delegate, here is why forcing the stakers to absorb this hit will permanently destroy Aave’s insurance layer.
1. The Real Definition of “First-Loss Capital”
When we staked our WETH in the Umbrella module, we agreed to act as the economic backstop for market and liquidity risks. We underwrote the risk that a volatile asset might dump faster than liquidators could clear it, or that on-chain congestion might cause temporary insolvency. We underwrote backed collateral.
We did not agree to insure an upstream LayerZero bridge exploit. We did not agree to pay for wrapped rsETH that was minted out of thin air against a drained escrow.
Kelp DAO running a bridge with hundreds of millions in TVL using a requiredDVNCount = 1 configuration is a systemic failure of infrastructure. That is not economic insolvency; that is a catastrophic oversight by the risk teams who vetted the asset.
2. The E-Mode Governance Failure
The rumors currently circulating about the e-mode listing cannot be ignored. If risk service providers and delegates aggressively pushed to get rsETH listed as collateral in Aave’s highest-leverage environment simply because Kelp DAO was a treasury management client, that is a glaring conflict of interest.
Umbrella stakers are being asked to act as the “meat shield” for a bad debt crisis that was entirely preventable, compounded by overly aggressive borrow caps and compromised governance standards. We are not paying for your backdoor deals.
3. The Death of the Umbrella Module
If the slash() function is allowed to execute and wipe out the WETH vault to cover this specific failure, the Umbrella module is dead.
Think about the precedent: Why would anyone ever provide first-loss capital to Aave again if the risk parameters include unvetted, black-swan bridge hacks? If the DAO socializes the profits of aggressive listings but forces the stakers to eat the losses of negligent infrastructure, Umbrella TVL will permanently drop to zero. The protocol cannot afford to lose its insurance layer.
The Path Forward
This is not a clean, automated smart contract execution; this is a multi-party governance negotiation.
The Aave DAO Treasury (Collector) holds over $200M in liquid assets. The DAO must step in and assume liability for this failure in risk management.
Our demands should be clear:

  1. Pause the Slash: The Guardian must prevent any automated slashing of the WETH Umbrella vault related to the rsETH exploit.

  2. Treasury Intervention: The Aave DAO must utilize Collector funds to cover the mainnet V3 residual bad debt.

  3. Hold Kelp Accountable: Bridged rsETH holders and the DAO must pursue Kelp and LayerZero for recovery, rather than punishing the Aave stakers who played by the rules.

Code is law, but the mandate matters. We underwrote the market. We didn’t underwrite the bridge. Aave governance needs to own this fix.

6 Likes

Hi everyone,

​First of all, I would like to sincerely apologize for speaking up as a “newbie” here. I am still learning the deep technical intricacies of Aave, but I have tried to objectively map out the current situation based on on-chain facts and the 2026 regulatory framework. Here is what I’ve gathered:

1. Liquidity vs. Total Damage (De Facto)

While it is a significant signal that Marc Zeller and the ACI are withdrawing the 100 Frontier validators (approx. 3,200 ETH / $11M), we must remain realistic: With bad debt totaling roughly $236M, this de facto covers only about 4.6% of the damage. It serves as a vital “injection” for immediate liquidity in the WETH pool, but it is not a cure for the deficit.

2. The 18% Collateral Gap

The math is straightforward: 116,500 rsETH are missing out of a total supply of approximately 630,000 ETH. This represents an 18% gap. However, de facto, 533,000 ETH still remain with Kelp. The system is not insolvent; it is under-collateralized.

3. Legal Liability (MiCA & DORA)

As per my understanding of the 2026 regulations:

  • MiCA Art. 75: Kelp, as the issuer, is liable for the loss of assets resulting from operational/technical failures (bridge configuration).

  • Liability Waivers: Any contractual exclusions for such liability are ineffective under MiCA.

  • Conclusion: Since Kelp still holds over 533k ETH, it is de facto their legal obligation to utilize these holdings to cover the Aave debt before Aave stakers or the DAO treasury are permanently impacted.

​Again, I apologize if my perspective seems simplistic, but the numbers don’t lie.

4 Likes

The umbrella security module doesn’t cover lost funds, so why should AAVE DAO? Does it mean you don’t want to be the scapegoat, but the token holders are? Please have some basic empathy.

1 Like

I’d like to remind everyone we don’t know what the bad debt situation will look like until we know how Kelp will handle their side. In the case they socialize losses across everyone (the most likely scenario), AAVE will only have to cover 10-20% of the debt ($25M-$50M). In the case they either do nothing or socialize the losses only amongst L2s, AAVE may have to cover any bad debt across L2s that arise from that.

I guarantee you that AAVE Labs isn’t just twiddling their thumbs and waiting, but rather some discussions are being had in backrooms not only amongst themselves but also Kelp and interested parties that will lend to them (such as Tether or Circle).

Patience.

2 Likes