- Aave’s TVL fell 44% in one month as DefiLlama data showed that 31 of the top 50 DeFi protocols posted monthly losses.
- Aave restored WETH borrowing limits across six V3 markets after emergency restrictions followed the KelpDAO-linked rsETH exploit.
DeFi confidence has faced one of its sharpest resets in months after the KelpDAO-linked rsETH exploit shook lending markets and forced emergency action across major protocols. Aave, one of the sector’s largest lending networks, has now restored wrapped Ether borrowing limits across six Aave V3 markets, but the recovery comes after a month of heavy capital flight.
The April incident centered on KelpDAO’s rsETH, a yield-bearing token tied to restaked ether. Attackers used a LayerZero bridge misconfiguration to mint about $292 million in unbacked rsETH. They then used those tokens as collateral and drained about $230 million in ether from Aave, forcing the protocol to move quickly to limit further risk.
Aave responded by cutting wrapped ether loan-to-value ratios to 0% across affected markets. That move stopped users from borrowing against WETH positions, even though WETH remains one of DeFi’s most widely used collateral assets. The restriction reduced leverage, slowed liquidity activity, and left many users waiting for risk teams and governance participants to contain the fallout.
The damage spread beyond the exploit itself. DefiLlama data showed Aave’s total value locked near $26.57 billion on March 17. By mid-May, the figure had fallen to around $14.77 billion, marking a 44% monthly decline. Therefore, about $11.6 billion left the protocol during a period when traders reduced exposure across decentralized finance.
The wider DeFi market weakened during the same period. Data showed that 31 of the top 50 protocols recorded TVL losses over 30 days. Nine of the top ten DeFi applications also posted declines, showing that users treated the incident as a broader sector risk rather than a single-protocol problem.
Earlier this month, Solv Protocol moved $700 million in Bitcoin assets from LayerZero to Chainlink CCIP after reviewing cross-chain security risks. Later on, Lombard followed the same path and said it would migrate about $1 billion in Bitcoin assets to Chainlink CCIP. The two moves show how the KelpDAO exploit has pushed major DeFi protocols to reassess bridge security and shift toward more secure infrastructure.
Aave Reopens WETH Borrowing After Risk Controls
Aave has now restored normal WETH loan-to-value ratios across Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle, and Linea. Governance records show the restored limits include 80.5% on Ethereum Core, 84% on Ethereum Prime, 80% on Arbitrum, 80% on Base, 80.5% on Mantle, and 80% on Linea.
In accordance with the rsETH technical recovery plan, WETH LTVs on Aave V3 Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle, and Linea have been restored to their pre-incident values.
WETH now operates as normal across all affected V3 deployments.
— Aave (@aave) May 17, 2026
The decision returns WETH to its normal role inside Aave’s lending markets. Traders use WETH to borrow stablecoins, manage leverage, support liquidity positions, and move capital across DeFi strategies. When Aave disabled that borrowing capacity, it protected the protocol from further stress but also reduced capital efficiency across several networks.
Recovery efforts have also reduced the shortfall tied to the exploit. Attackers reportedly minted about 112,103 unbacked rsETH during the exploit. Industrywide efforts have reclaimed 106,993 rsETH; Aave and Compound recovered 89,567 rsETH and 17,426 rsETH, respectively.
That leaves a remaining shortfall of about 5,200 rsETH. The DeFi United coalition expects to cover that gap, with repayments calculated for affected users and set to be disbursed in WETH. Even so, unresolved legal and liability questions remain around frozen assets and final responsibility for the losses.
Lido now leads DeFi by TVL despite a 13.36% monthly decline, holding about $19.29 billion. Binance Staked ETH ranks third with roughly $8.05 billion after a 7.47% drop, while Morpho holds about $7.46 billion after a smaller 1.33% decline. Eigencloud also remains in the top five, though it lost more than 27% over the month.
Securitize stood out as the only top-ten protocol to avoid the downturn, while Sky, Ethena, Spark, and Ether.fi all posted losses. The pattern shows how quickly confidence can narrow after a major exploit, especially when core collateral assets face emergency restrictions.
