Aave Freezes rsETH Markets Following Kelp DAO Bridge Vulnerability

The decentralized lending protocol Aave has officially frozen all rsETH markets across its V3 and V4 iterations following a security breach involving the Kelp DAO bridge. This proactive measure was implemented on April 19, 2026, to safeguard the protocol's liquidity pools and prevent the accumulation of further risk while developers assess the extent of the damage. While Aave’s core smart contracts remain secure and were not directly compromised, the volatility and potential loss of backing for rsETH necessitated an immediate halt to all deposit and borrowing activities involving the asset.

Impact Assessment and Security Measures

The decision to freeze the markets stems from a vulnerability discovered in the Kelp DAO rsETH bridge, a critical piece of infrastructure for the Liquid Restaking Token (LRT). By disabling these markets, Aave ensures that no new users can deposit the affected asset or use it as collateral to draw loans in other cryptocurrencies such as USDC or Ethereum (ETH). Freezing a market is a standard emergency procedure in DeFi to isolate a specific asset's risk from the rest of the protocol's treasury.

The Aave team has clarified several key points regarding the current status of the protocol:

• The attack was specific to the rsETH ecosystem, not the Aave protocol itself.
• Aave V3 and V4 no longer hold active rsETH reserves for new transactions.
• Existing positions are being monitored to determine the impact on the protocol’s health factor.

Addressing Potential Bad Debt and Recovery

A primary concern for the Aave governance community is the potential for bad debt—a scenario where the value of the rsETH collateral falls below the value of the borrowed assets due to the exploit. The technical team is currently reviewing all historical borrowing data linked to rsETH to quantify any discrepancies.

If the protocol incurs bad debt due to this incident, the team will explore avenues to cover the losses.

This statement suggests that Aave may utilize its Safety Module or other reserve funds to maintain the solvency of the platform if the Kelp DAO incident results in unrecoverable liquidations. This mechanism is designed to act as a backstop, ensuring that lenders on the platform do not face capital losses due to external smart contract failures of collateral assets.

In conclusion, the incident highlights the interconnected risks within the DeFi and liquid restaking ecosystem. While the Aave protocol's internal security remained intact, the reliance on external bridged assets like rsETH introduces third-party dependencies. Stakeholders are advised to monitor official communication channels for a detailed post-mortem and updates on when, or if, the rsETH markets will be unfrozen.