The decentralized finance (DeFi) sector was rocked over the weekend by a major exploit and subsequent liquidity crisis, centering on lending giant Aave. The turmoil began on Saturday, April 18, 2026, when an attacker exploited a vulnerability in KelpDAO's LayerZero-based cross-chain bridge. This enabled the malicious actor to manipulate the protocol's messaging layer, resulting in the unauthorized release of 116,500 rsETH tokens, representing roughly 18% of the total circulating supply and worth approximately $292 million at the time.
The fallout quickly spread to Aave. The attacker used the stolen rsETH as collateral to borrow funds on the Aave platform, creating what experts described as "massive bad debt." This activity caused the utilization rate of Aave's core Ethereum and Wrapped Ethereum (WETH) lending pools to spike to 100%, effectively locking depositors' funds and preventing withdrawals.
The situation escalated dramatically following a cryptic warning tweet from Marc Zeller, founder of the Aave-Chan Initiative (ACI) and a former influential figure in Aave's governance. On X, Zeller posted, "If you have WETH on Aave V3 Core, withdraw now, ask questions later." This message, interpreted by many as an insider alarm, triggered a massive wave of panic withdrawals. According to data from EmberCN and DefiLlama co-founder 0xngmi, net withdrawals from Aave reached between $6.2 billion and $6.6 billion within hours. Half of this amount, roughly $3.3 billion, was in stablecoins.
High-profile withdrawals included Justin Sun, founder of Tron, who pulled out 65,584 ETH (worth ~$154 million) from Aave, later depositing a portion into Spark, a direct Aave competitor. The liquidity crunch forced borrowers using ETH as collateral for stablecoin loans to be unable to unwind their positions, even as stablecoin borrowing rates on the platform surged to between 10% and 15%.
Aave's Total Value Locked (TVL) plummeted from over $26.3 billion on April 18 to around $19.8 billion. Its governance token, AAVE, crashed by over 18% in 24 hours, trading near $92.2. In response, Aave froze markets tied to the rsETH token. Zeller later declared the situation "under control" and announced the immediate end of ACI's Frontier ETH staking program, offering its validator ETH to Aave's DAO to help protect WETH depositors, though he admitted "It won't help much."
The incident has exposed underlying tensions within the Aave ecosystem. Zeller's ACI, along with developer teams BGD Labs and risk curator Chaos Labs, have recently announced their exits following governance disputes with Aave Labs over fee redirection and alleged undisclosed voting power.
Spark's head of strategy, monetsupply.eth, noted that their protocol's conservative policies—deprecating rsETH as collateral in January and maintaining high borrow rates—left it with ample liquidity while Aave markets across Mainnet, Arbitrum, Plasma, Mantle, and Base locked up. The event has raised serious questions about cross-chain bridge security, DeFi contagion risks, and the fragility of interconnected lending protocols.
