Users attempting to withdraw Wrapped Ethereum (WETH) from major lending protocol Aave are currently blocked after the platform deliberately froze specific reserves. The targeted freeze is a precautionary measure to contain the fallout from a $292 million exploit of the liquid restaking protocol KelpDAO, which created massive bad debt across decentralized finance (DeFi) markets.
While panic initially sparked fears of a total platform bank run, Aave clarified that the withdrawal block only applies to specific assets. WETH and rsETH reserves remain frozen across the Ethereum mainnet, Arbitrum, Base, Mantle, and Linea networks. All other cryptocurrency reserves on the platform remain fully operational and available for withdrawal.
WETH is an ERC-20 compatible version of Ethereum (ETH). It is always pegged 1:1 with regular ETH. rsETH is a specific “Liquid Restaking Token” (LRT) issued by the protocol Kelp DAO.
Here is a timeline of how this new DeFi hack of 2026 unfolded and prompted the protocol freezes.
April 18, 2026: The Exploit and Bad Debt
- The Bridge Hack: An attacker exploited a vulnerability in KelpDAO’s rsETH cross-chain bridge, built on LayerZero infrastructure. By forging cross-chain messages, the attacker tricked the network into releasing 116,500 rsETH without burning the corresponding tokens.
- $292 Million Drained: The stolen tokens represented about 18% of the entire circulating supply of rsETH, valued at approximately $292 million.
- The Spillover to Aave: Instead of fleeing with the stolen rsETH, the attacker deposited the assets as collateral into major lending protocols, including Aave V3, Compound V3, and Euler.
- Creating the Bad Debt: The attacker used the unbacked rsETH to borrow massive amounts of Wrapped Ethereum (WETH). Because the rsETH collateral was functionally worthless, these borrowing positions became unliquidatable, leaving Aave with an estimated $177 million to $290 million in bad debt.
April 19, 2026: Contagion and Targeted Freezes
- Billion-Dollar Withdrawals: Panic over the bad debt triggered a massive wave of withdrawals. Users pulled roughly $6.2 billion from Aave, causing its Total Value Locked (TVL) to drop from $26.4 billion to nearly $20 billion.
- Whale Exits: High-profile users accelerated the drain. Tron founder Justin Sun urgently withdrew 65,584 ETH (worth roughly $154 million) from Aave, moving the funds into Spark.
- Protocol Intervenes: To prevent a complete drain of WETH liquidity and isolate the risk, Aave governance stepped in. The protocol officially froze all rsETH markets and WETH reserves across its V3 and V4 platforms on affected chains.
- Token Plunge: The native $AAVE governance token crashed between 16% and 18% within 24 hours as large holders and whales dumped millions of dollars worth of the asset.
April 20, 2026: Ongoing Investigations
- No Direct Protocol Compromise: Aave founder Stani Kulechov and official channels confirmed that Aave’s internal smart contracts were not compromised and that rsETH on the Ethereum mainnet remains fully backed. Exposure to the incident has been capped.
- Calls for Negotiation: Justin Sun publicly appealed to the hacker, offering to negotiate a return of the stolen funds. Sun warned that a loss of this magnitude is “not worth it to sacrifice both Aave and KelpDAO and let them go down.”
- Current Status: As of Monday, KelpDAO contracts and Aave’s WETH and rsETH markets remain frozen while Aave actively validates information and assesses potential resolutions for the bad debt.
This article is published on BitPinas: Timeline: Aave Freezes WETH as $292M KelpDAO Exploit Triggers Liquidity Crunch
Listen to our latest episode
What else is happening in Crypto Philippines and beyond?