# Aave Incurs $200M Bad Debt After KelpDAO rsETH Exploit Trigger Umbrella Slashing

Source: https://www.ainvest.com/news/aave-incurs-200m-bad-debt-kelpdao-rseth-exploit-triggers-umbrella-slashing-2604

## Comments

**mishaderidder.eth**: > The incident marks the first major real-world test of Aave's automated Umbrella system, which replaced the legacy Safety Module. The protocol confirmed that its own smart contracts were not directly compromised, but the design allowed the third-party bridge attack to propagate losses to the lending reserve. As confirmed, depositors of WETH now face potential slashing of staked assets to cover the unrecoverable obligations left by the attacker.

Interesting. 

**timdaub.eth**: Is the headline here true? Because I haven‘t really seen that 200M USD officially confirmed anywhere

**mishaderidder.eth**: I think so. This is from Forbes: https://www.forbes.com/sites/digital-assets/2026/04/18/withdraw-now-inside-aaves-sudden-200m-bad-debt-crisis/

**mishaderidder.eth**: https://x.com/marczeller/status/2045583631184282047

**timdaub.eth**: Re 200M USD loss: It depends how much the deposited rsETH is worth. If that rsETH is completely worthless, then yes Aave's loss is 200M or more. But if all rsETH holders get a haircut because the supply of rsETH has increased, but the underlying ETH is the same, then Aave has incurred way less bad debt and maybe the Umbrella can cover

**timdaub.eth**: What's weird is that rsETH/ETH has basically remained pegged, which signals that all rsETH can be redeemed 1:1 for ETH. Not sure what this means though. Does it mean that also Aave will be able to redeem its rsETH?

**timdaub.eth**: Sorry, forgot the link to the chart: https://www.coingecko.com/en/coins/kelp-dao-restaked-eth/eth

**mishaderidder.eth**: No, I don’t think so, the peg holding does not mean Aave can redeem its rsETH at 1:1. What looks like a healthy peg is actually a partial illusion created by the bridge freeze. Aave's specific rsETH holdings are almost certainly part of the unbacked tranche.

**mishaderidder.eth**: The real test comes when and if Kelp reopens redemptions and decides how to distribute the loss.

**timdaub.eth**: Agree but there are many conditions. Eg the Umbrella on mainnet covers a 55M USD shortfall. But not on Arbitrum. Plus, the hacker managed to steal the rsETH on mainnet and so only those rsETH on L2s are technically unbacked now

**mishaderidder.eth**: > The issue is that Aave has no control over how KelpDAO decides to handle the loss.

https://news.kiwistand.com/stories/Aave-Umbrella-stakers-on-mainnet-shouldnt-cover-rsETH-losses-from-Arbitrum?index=0x69e4fee3ad419b3361bd83e2ad8b62923be97b0cd657c254f07ace5765f7f2612827031a

The thing is Aave's mainnet Umbrella stakers signed up to underwrite mainnet risk, but the actual loss geography doesn't map neatly onto Umbrella's per-chain design.

**mishaderidder.eth**: This is really complex stuff btw 😅 but the I’m reading the more it looks like it is really about which interpretation Kelp adopts. 

So regarding your argument the scenario could be Aave's mainnet rsETH collateral would be redeemable 1:1 so bad debt disappears. But Arbitrum's $69M bad debt has no Umbrella coverage and falls directly on the Aave DAO Treasury. Mainnet Umbrella stakers get off with only an ~8% cut. That would actually be the worst scenario for Aave :) 

**timdaub.eth**: > This is really complex stuff btw 😅 but the I’m reading the more it looks like it is really about which interpretation Kelp adopts.

Yes, this is probably true. So it is somewhat scary that the degen ETH looper provider gets to decide my faith even though all I did was deposit actual ETH into Aave. I'm honestly quite pissed at that outcome. Not sure I will continue to use Aave if this persists and isn't isolated

> So regarding your argument the scenario could be Aave's mainnet rsETH collateral would be redeemable 1:1 so bad debt disappears. But Arbitrum's $69M bad debt has no Umbrella coverage and falls directly on the Aave DAO Treasury. Mainnet Umbrella stakers get off with only an ~8% cut. That would actually be the worst scenario for Aave :)

It's more complicated. It's about who you dilute. E.g. rsETH is less backed now. So technically Kelp has to decide who incurs the losses for the LayerZero bridge hack. Honestly, it would make sense if only those who deposited there also suffered the loss. But then also, if you socialize the losses then rsETH gets worth only 81% of its value. And then that factors into how much ETH is missing over at Aave. 

Plus, some long-time vested people can withdraw from the Umbrella right now. Already 20M USD I think was withdrawn from the Umbrella ETH pool. Plus, if the overall amount of ETH drops on Aave, those who remain on it will incur a greater shortfall vs those who just withdrew their ETH. So there are many variables.

**mishaderidder.eth**: I lost funds in the Balancer hack, though they were partially recovered by Gnosis DAO. Since then I’m much more cautious with DeFi. Until about a week ago I had funds deposited in Aave, but then I had a weird feeling and got anxious (maybe reading too much Kiwi news :) and pulled everything out. So luckily personally not affected now. 

**mishaderidder.eth**: aave labs preference

https://news.kiwistand.com/stories/MonetSupply-Aave-Labs-prefers-rsETH-losses-on-L2s-over-Ethereum-mainnet?index=0x69e54ae742f7f3ec3ec200f67ad0bf1d51ff09ece8a71e43cbd9d2c3a920d197cb5b2571