Key Takeaways:

• According to Llamarisk, an attacker exploited Kelp’s Layerzero V2 bridge on April 18, 2026, minting 116,500 rsETH without any corresponding burn.
• Llamarisk estimates bad debt between $123.7M and $230.1M across 7 affected markets, depending on how Kelp socializes losses.
• The Aave DAO treasury holds $181M as of April 20, 2026, and service providers are already securing indicative recovery commitments from ecosystem participants.

Llamarisk Details rsETH Exploit Scenarios After Kelp OFT Adapter Drained

The analysis published by risk management company Llamarisk and Aave service provider co-authors explained that the attack occurred at 17:35 UTC in Ethereum block 24,908,285. The Unichain-to-Ethereum route was configured as a 1-of-1 DVN path, meaning a single verifier could attest an inbound packet without any corresponding outbound action, according to the report.

Llamarisk authors said the attacker forged a packet that was verified, committed, and delivered on Ethereum, releasing 116,500 rsETH from the adapter, the Aave report notes. The adapter balance fell from 116,723 rsETH to 223 rsETH in a single block. The attacker fanned the stolen rsETH from one intake wallet across seven branch addresses. Of the 116,500 rsETH received, 89,567 were deposited into Aave V3 markets on Ethereum and Arbitrum as collateral.

Those positions were used to borrow approximately 82,650 WETH and 821 wstETH, with health factors settling between 1.01 and 1.03. All seven attacker addresses remain active on Aave at the time of publication.

Aave service providers co-authored Llamarisk’s full incident report and confirmed that Aave’s own smart contracts were not compromised. All protocol logic, including supply, repayment, and liquidation mechanics, continued to function as designed throughout the event.

The Protocol Guardian began freezing all rsETH and wrsETH reserves across all Aave V3 deployments at approximately 19:00 UTC on April 18. The action set LTV to zero and disabled new supply and borrowing while leaving existing positions eligible for repayment and liquidation. Eleven markets across Ethereum, Arbitrum, Avalanche, Base, Ink, Linea, Mantle, MegaETH, Plasma, and Zksync were affected, according to the Aave forum analysis.

The report says the Risk Steward adjusted WETH interest rate models on Arbitrum, Base, Mantle, and Linea at approximately 14:30 UTC on April 19, reducing Slope 2 to 1.50 percent and cutting the borrow rate at 100 percent utilization from between 8.5 and 10.5 percent down to 3.0 percent APR. A corresponding adjustment was applied to Core at approximately 05:00 UTC on April 20, with Slope 1 set to 2 percent, Slope 2 to 3 percent, and optimal utilization set to 94 percent.

The Protocol Guardian also froze WETH on Core, Prime, Arbitrum, Base, Mantle, and Linea at approximately 02:00 UTC on April 20 to prevent new borrowing and contain potential stress from spreading to stablecoin reserves.

The 2 Scenarios

The two scenarios modeled by Llamarisk’s analysis reflect how Kelp’s loss allocation decision will determine the protocol’s final exposure. Scenario 1 assumes uniform socialization of the 112,204 unbacked rsETH across the entire rsETH supply, producing a 15.12 percent depeg and an estimated $123.7 million in bad debt, with Ethereum Core absorbing $91.8 million in absolute terms and Mantle facing a 9.54 percent WETH reserve shortfall.