An incident report published by Llamarisk to the Aave forum explains that a bridge exploit targeting KelpDAO’s Layerzero V2 rsETH route on Saturday allowed an attacker to extract 116,500 rsETH from Ethereum’s OFT adapter without burning any tokens on the source chain. Llamarisk’s report notes that this incident exposed Aave V3 markets to potential bad debt ranging from $123.7 million to $230.1 million, depending on how losses are allocated.
Key Takeaways:
According to Llamarisk, an attacker exploited Kelp’s Layerzero V2 bridge on April 18, 2026, minting 116,500 rsETH without any corresponding burn. Llamarisk estimates bad debt between $123.7M and $230.1M across 7 affected markets, depending on how Kelp socializes losses. The Aave DAO treasury holds $181M as of April 20, 2026, and service providers are already securing indicative recovery commitments from ecosystem participants. Llamarisk Details rsETH Exploit Scenarios After Kelp OFT Adapter Drained The 2 ScenariosLlamarisk’s report flagged Base and Arbitrum as the least buffered markets, with first liquidations triggered at WETH price drops of 0.77 percent and 1.77 percent, respectively, due to positions running at health factors around 1.03.
A pause would block deposits, withdrawals, transfers, and slashing while keeping rewards distribution active. The remaining four rsETH-listed markets, Ethereum Lido, MegaETH, Plasma, and Zksync, carry trivial balances and no bad debt. Twelve additional Aave V3 markets do not list rsETH and are unaffected.
