Aave Disclosure: Depending on the loss allocation method, there may be two bad debt scenarios of $123.7 million and $230.1 million.

Deep Tide TechFlow News. On April 21, Aave risk service provider LlamaRisk released an incident report. On April 18, 2026, the attacker exploited a vulnerability in Kelp’s LayerZero V2 Unichain to Ethereum rsETH routing (a 1-of-1 DVN configuration flaw). They forged inbound data packets, illegally released 116,500 rsETH from the Ethereum adapter, and deposited 89,567 of them as collateral into multiple Aave V3 markets (involving Ethereum Core and Arbitrum, etc.), borrowing approximately 82,650 WETH (about $191 million) and 821 wstETH.

Currently, only 40,373 rsETH remain in the adapter, while the total rsETH claims on the remote chain reach 152,577, leaving a huge gap. Depending on different loss-allocation methods, Aave faces two bad-debt scenarios: Scenario 1 (global pro-rata allocation) is expected to result in bad debt of about $123.7 million, with Ethereum Core taking the largest burden; Scenario 2 (loss limited to L2) is expected to result in bad debt of about $230.1 million, with Mantle facing a WETH reserve shortfall of up to 71.45%, and Arbitrum at 26.67%.

After the incident, the Aave protocol guardians and risk administrators immediately froze the rsETH/wrsETH reserves across all 11 markets and set LTV to zero. They also lowered multi-chain WETH interest rates and froze WETH lending. The Aave smart contracts themselves were not attacked, and the protocol logic is operating normally. The Aave DAO treasury currently holds assets worth approximately $181 million, which provides some capacity to cover bad debts, and related ecosystem partners have also made initial support commitments. The subsequent disposal plan will be determined based on Kelp’s official loss-allocation decision.