The protocol kept operating after the KelpDAO rsETH bridge exploit drained liquidity in some markets, highlighting how cross-chain shocks can strain decentralized credit without halting withdrawals.
Aave continued operating after about $8.45 billion in withdrawals followed the April 2026 exploit of the KelpDAO rsETH cross-chain bridge, which stole about $292 million. Liquidity in some lending markets was rapidly depleted and utilization briefly neared 100%, but Aave adjusted risk parameters and used emergency mechanisms to keep the protocol functioning. Analysts said the episode exposed structural risks in DeFi lending, where stress from collateral and bridge failures can quickly spread through interconnected markets even when user withdrawals are still processed.