Aave, one of crypto’s largest lending and borrowing protocols, still hasn’t recovered from the April 18 hack of KelpDAO.
Indeed, the value of all crypto assets in its smart contracts is down 43% since the attack, and 67% below its 52-week high.
Despite KelpDAO users entrusting $26.4 billion to Aave just prior to the hack — already way down on the October 2025 peak of $45.9 billion — there’s a mere $14.9 billion worth of assets in the ecosystem today.
North Korean hackers looted KelpDAO in mid-April, and through its acceptance of KelpDAO tokens as collateral for loans, Aave was left nursing a nine-figure loss.
North Korea infected the industry
Despite Aave itself never being hacked, per its own report, its utility for lending cost it a long-held title as DeFi’s biggest platform. Four months later, depositors still have cold feet.
LayerZero, the KelpDAO bridge’s software provider, blamed North Korea within 48 hours — an early call that outside investigators later confirmed.
KelpDAO takes deposits of $ETH, stakes on Ethereum’s blockchain for yield, and issues a tradeable receipt token called rsETH. The thieves parked stolen rsETH on Aave and borrowed real $ETH against it, leaving Aave and fellow lender Compound with an estimated $246 million of combined bad debt.
Aave forcibly liquidated the attacker’s positions, industry allies rebuilt the missing collateral, and by late May, Aave had declared every market back to normal.
Nevertheless, the dollar value of its liquidity pools never recovered and Aave still sits about two-thirds below its October peak.
Aave dismisses restraining notice for rescued funds as ‘finders keepers’
Aave’s decline matters for DeFi
A non-custodial lending app, Aave ended 2025 with $55 billion in TVL, worth more than half of the DeFi lending sector’s TVL.
For a borrower, TVL isn’t an abstraction. It illustrates the dollar equivalent values of deposits and inventory that borrowers can draw on.
A pool worth 43% less has that much less to lend and much higher volatility.
According to investigators at Chainalysis, North Korea’s Lazarus Group was probably helping KelpDAO attackers while LayerZero’s own post-mortem attributed the operation to a North Korean-linked cluster going by TraderTraitor.
Protos has also reported alleged on-chain links to Bybit and BTC Turk hacks.
Aave never really recovered from KelpDAO
Aave fell about 20% over the day after the theft, from roughly $115 to below $92. The token trades near $89 today, still slightly below its pre-hack level.
Within two days of the hack, Aave’s deposits collapsed by more than $8 billion and its stablecoin pools hit 100% utilization, leaving billions of crypto dollars effectively frozen with no room for anyone else to withdraw stablecoins.
On April 27, Aave announced that a new coalition, DeFi United, had pledged enough $ETH to restore rsETH’s full backing. It then liquidated the attacker’s positions on Ethereum and Arbitrum on May 6. Replacement collateral flowed into the bridge’s reserves in tranches through late May.
The panic hadn’t ended even by May. TVL kept draining into June, bottoming near $11.9 billion before partially recovering.
Aave now sits near $14.9 billion, down 43% from hack day.
According to its own report, Aave’s contracts, oracles and liquidation mechanics worked exactly as designed, yet North Korea was still able to withdraw money using phony collateral.
