Aave restores WETH borrowing after rsETH exploit recovery

Aave announced on May 17 that borrowing against wrapped Ether (WETH) is back on Ethereum Core, Prime, Arbitrum, Base, Mantle and Linea after the protocol lifted the emergency restrictions imposed in mid‑April 2026 [2].

The freeze traced back to an April 18 attack on Kelp DAO’s cross‑chain bridge, where a hacker forged a LayerZero message and minted roughly 116,500 rsETH—worth about $292 million—before the contracts were paused [1]. The stolen rsETH was immediately used as collateral on Aave V3, allowing the attacker to pull out roughly $195‑236 million of WETH, creating bad debt estimated between $177 million and $200 million for Aave [1][2]. In response, Aave’s governance froze WETH borrowing across its major deployments to protect depositors and give the team time to address the fallout [1].

During the weeks that followed, Aave’s Umbrella safety module slashed aWETH holders to cover the deficit, while the protocol gradually restored liquidity, reopened withdrawals, and liquidated vulnerable positions [1]. Community proposals helped lower utilization pressures and rebuild confidence, but the protocol’s total value locked still sits about $8 billion below its pre‑attack peak of $23.5 billion [2].

With the rsETH technical recovery now complete, Aave restored the original loan‑to‑value (LTV) ratios for WETH collateral, returning the market to its pre‑incident state and allowing users to once again leverage WETH for loans or perform collateral and debt swaps [2]. The move signals that the immediate systemic risk has been contained, but the incident highlights how a single token’s failure can cascade through DeFi lending pools and test new risk‑mitigation mechanisms.

The real question now is whether Aave’s Umbrella framework and tighter governance will prevent a similar cascade if another liquid restaking token falters, or if the protocol will need further parameter tweaks as the ecosystem rebuilds trust.