Aave is assessing the consequences of the largest DeFi incident of 2026. After the $293 million KelpDAO hack, the protocol faced bad debt, and risk managers have already calculated two possible scenarios. The choice between them will determine exactly where the losses will remain and how severely the ecosystem will be affected.
It is not just about the numbers. The situation has shown how quickly a local failure can turn into a systemic risk for the entire lending segment.
The Hack Quickly Spread Beyond a Single Protocol
The incident began with an attack on the KelpDAO bridge. The attacker obtained 116,500 rsETH and used these assets as collateral in Aave v3.
The chain of events then developed in a familiar way. Large amounts of wETH were borrowed against the collateral, while the rsETH itself was left unbacked. This is what created the problem. The positions cannot be liquidated, so the debt remains within the system.
The First Scenario Distributes Losses
In the first scenario, losses are distributed among rsETH holders on the mainnet and on layer 2 networks. This approach reduces the burden on the protocol itself.
The estimated losses in this case are about $123.7 million. But this solution comes at a cost. The rsETH price could deviate from ether by about 15%. This is the key risk. Losses are spread across the system, but trust in the asset suffers.
The Second Scenario Concentrates the Blow
The alternative scenario is harsher. All losses are shifted to layer 2 networks, such as Arbitrum and Mantle.
In this case, the bad debt increases to $230 million. This is almost twice as much as in the first scenario. However, the main Ethereum network remains protected. Losses become localized, but more painful for specific segments.
The Choice Is Between Stability and the Scale of Losses
Essentially, the market faces a simple choice. Either spread the damage more widely and reduce its concentration, or preserve the stability of the base layer at the cost of larger losses in certain networks.
Both scenarios have consequences. One hits the asset price, the other affects liquidity and the balances of layer 2 protocols. That is why the final decision is of systemic importance.
Aave Has a Safety Margin
Importantly, the protocol has resources to partially cover the losses. The treasury holds about $181 million.
In addition, some funds are already in the protection mechanism. Nearly 19,000 aWETH have entered the withdrawal phase, which can be used for compensation. This does not completely solve the problem. But it reduces the risk of the situation spiraling out of control.
The Scale of Outflows Shows the Level of Stress
After the attack, nearly $10 billion has already been withdrawn from Aave. This is one of the fastest liquidity outflows in recent times.
This movement is not only related to technical factors. It is a reaction to risk. When users see unliquidatable positions, they start to act in advance.
The Cause of the Attack Was a Bridge Vulnerability
KelpDAO disclosed the details. Two bridge nodes were compromised, and a third was subjected to a denial-of-service attack.
The attacker generated a message that was valid from the system’s perspective and issued rsETH without real backing. This raises the old problem again. Bridges remain the weak link of the entire ecosystem.
Contracts Stopped, Damage Limited
After the attack, KelpDAO quickly halted contracts and blocked the attacker’s addresses. This prevented the additional issuance of about 40,000 more rsETH.
The response was quick. But the damage had already been done. And it is now being redistributed within the system.
What This Means for DeFi
The situation around Aave shows the main point. Risk in DeFi is not isolated. One hack leads to collateral problems. Then bad debt appears. After that, liquidity outflows begin. This cycle repeats. And each time it happens faster.
What Is Next?
The final decision depends on KelpDAO and market participants. They will determine which scenario will be implemented. Much depends on this: the structure of losses, trust in rsETH, and the speed of liquidity recovery.
For now, the market remains in a waiting mode. But the main point is already clear. Even large protocols are not protected from external shocks if they are embedded in a single chain of risks.
Read More: How Mastercard Plans to Process Card Payments Through Stablecoins
