Aave’s total value locked drops 43% after KelpDAO hack, still below pre-attack levels

Aave’s locked assets remain 43% lower after KelpDAO hack

Aave, a leading decentralized finance (DeFi) platform for lending and borrowing cryptocurrency, has not recovered from the April 18 hack of KelpDAO. The total value locked (TVL)—the amount of crypto assets deposited in Aave’s smart contracts—is still 43% lower than before the attack. At its peak in October 2025, Aave held $45.9 billion in assets, but today, it holds just $14.9 billion.

The hack targeted KelpDAO, a service that stakes Ethereum (ETH) for users and issues a token called rsETH as a receipt. Hackers used stolen rsETH as collateral to borrow real ETH from Aave, leaving the platform with significant losses. Though Aave itself was not hacked, its reliance on KelpDAO’s tokens as collateral led to a $246 million bad debt shared with another lender, Compound.

Key details of the hack and recovery

• Aave’s TVL dropped from $26.4 billion just before the hack to $14.9 billion today.
• The hack was linked to North Korean groups, according to LayerZero and Chainalysis.
• Aave liquidated the attacker’s positions and restored collateral with help from a coalition called DeFi United.
• The platform’s native token, AAVE, fell 20% immediately after the hack and remains below its pre-attack price.
• Stablecoin pools on Aave hit 100% utilization, freezing withdrawals for some users.

Aave’s response and industry impact

Aave stated that its smart contracts and security systems worked as designed, but the hack still exposed risks in DeFi lending. The platform forcibly liquidated the attacker’s positions and received replacement collateral in stages through May. Despite these efforts, depositors have not returned in large numbers, and Aave’s TVL remains far below its peak.

Before the hack, Aave accounted for more than half of the DeFi lending sector’s TVL. A smaller TVL means less liquidity for borrowers and higher volatility for the platform. Investigators confirmed that North Korean hackers were likely involved, with LayerZero attributing the attack to a group called TraderTraitor.

What is confirmed about the hack

• Aave’s TVL is down 43% since the KelpDAO hack and 67% below its October 2025 peak.
• The hackers used stolen rsETH as collateral to borrow ETH from Aave, creating $246 million in bad debt.
• Aave’s contracts and liquidation mechanisms functioned as intended, but the attack still caused losses.
• North Korean groups were likely responsible, according to LayerZero and Chainalysis.
• Aave’s token price dropped 20% immediately after the hack and remains below pre-attack levels.

What remains unclear

• Whether Aave’s TVL will fully recover to pre-hack levels.
• If depositors will regain confidence in DeFi lending platforms after this incident.
• How long it will take for the DeFi sector to address vulnerabilities exposed by the hack.

Why this matters for DeFi users

Aave’s decline highlights risks in DeFi lending, where platforms rely on third-party tokens as collateral. The hack showed that even if a platform’s security works correctly, external vulnerabilities can still cause major losses. For users, this means:

• Less liquidity available for borrowing.
• Higher volatility in lending pools.
• Increased caution from depositors, which could slow growth in DeFi.

Sources

• Protos
• Aave Incident Report
• LayerZero Incident Report