Why I withdrew everything from Aave this weekend
By Mehab Qureshi
Published on April 19, 2026.
Ave V3, a decentralized platform that allows for lending and storing stablecoins and ETH, was hit by a security breach over the weekend. An attacker exploited a vulnerability in Kelp DAO’s cross-chain bridge, which uses LayerZero's messaging infrastructure, to release roughly 116,500 rsETH worth around $292 million to a wallet under their control. The stolen funds were used as collateral for Aave V3 and the liquid restaking token, which is supposed to be redeemable for the ETH backing it. The bad debt on Aave is estimated at $177 million to $200 million. The attacker used the stolen funds to borrow as much WETH as the protocol would allow, resulting in a loss of roughly $6.6 billion in deposits within 24 hours. Two subsequent attempts to drain another 80,000 rsETH were blocked by a freeze saving the ecosystem an additional $100 million or so in losses. The security breach left the collateral of these borrows effectively worthless.
Read Original Article