Aave faces $195M in bad debt after KelpDAO bridge exploit as Spark absorbs billions in fleeing capital

A cross-chain bridge exploit drained roughly $292M worth of unbacked rsETH tokens from KelpDAO, and the fallout landed squarely on Aave’s balance sheet. The attacker used those freshly minted tokens as collateral to borrow $190M in WETH and stablecoins across Aave V3 and V4, leaving the protocol staring at approximately $195M in bad debt. SparkLend, the lending arm under MakerDAO, had already reduced its rsETH exposure before the incident. The protocol absorbed between $1.4B and $1.7B in new deposits from users scrambling for safer ground, effectively doubling its total value locked within days. How the exploit unfolded On April 18, roughly 116,500 rsETH tokens were minted without backing through KelpDAO’s LayerZero-powered bridge. That figure represented about 18% of rsETH’s entire supply. The attacker then deposited those tokens into Aave as collateral. Because Aave’s markets recognized rsETH at face value, the protocol processed the borrows like any other transaction. The result was $190M in borrowed assets that will almost certainly never be repaid. Estimates for the resulting bad debt range from $124M to $230M depending on recovery assumptions, but $195M has emerged as the mos...