Aave’s risk manager discussed two possible bad debt scenarios after the Kelp DAO hack, during which $293 million worth of 116,500 Kelp DAO Restaked ETH (rsETH) tokens were taken from the LayerZero-powered bridge.
The attacker converted the stolen rsETH to collateral on Aave V3 for borrowing wrapped Ether (wETH), which resulted in liquidity pressure and led to the protocol losing almost $10 billion in outflows since the incident. According to LlamaRisk, the analysis highlights how one compromised bridge could result in a chain reaction of problems through different lending protocols in DeFi.
Scenario One: Losses Are Shared, Depeg Risk Arises
The first scenario sees the losses shared among all rsETH holders on the Ethereum mainnet and layer 2 networks, which leads to about $123.7 million in bad debt on Aave. The way this goes is the 15% depeg of rsETH against Ether. In absolute terms, Wrapped Ether reserves would be the ones taking the biggest hit, but they should still remain stable because of their depth.
Aave, on the other hand, might use its Umbrella security model to make up for wETH shortages with 18,922 aWETH, equivalent to $43.7 million, having already entered unstaking cooldown.
Also Read: 606 Million Crypto Hack in April Exposes Cracks in Blockchain Security
Scenario Two: Layer 2 Concentration
The second scenario decided to concentrate the entire shortfall on Ethereum layer 2 networks such as Arbitrum and Mantle; this way, bad debt rose to $230.1 million. Although it is a more expensive option, it better safeguards the Ethereum mainnet and localizes the impact. Aave treasury, which is holding roughly $181 million, may, in a way, be able to cover the exposure, but that would greatly depend on the decisions of governance.
Also Read: Ethereum Buying Pressure Hits 2-Year High as Binance Ratio Surges
Exploit Mechanics and Ongoing Response
Kelp DAO revealed that there were two LayerZero bridge nodes that were compromised and a third node that was hit with a DDoS attack. Attacker falsely signed a transfer message, thus minting 116,500 rsETH. After pausing all contracts and blacklisting exploiter wallets, the team was able to prevent the theft of 40,000 rsETH, which is approximately $95 million. Kelp DAO is still evaluating the extent of the financial loss and planning with Aave and LayerZero the steps for the remediation.
Also Read: Strategy Surpasses 800,000 Bitcoin as SEC Filing Confirms STRC Purchase Funding
