Aave WETH Suppliers Urged to Withdraw After KelpDAO rsETH Exploit

A $290M exploit of KelpDAO’s rsETH left Aave V3 holding unbacked debt after the attacker supplied stolen rsETH as collateral and borrowed WETH, creating effectively unliquidatable positions. Solidity auditor 0xQuit warned WETH depositors to withdraw if possible; partial withdrawals may remain blocked until Aave’s Umbrella backstop completes an automatic slashing cycle that will cut stakers (aWETH) to cover the deficit. Recovery to full withdrawals is not guaranteed and depositors may face haircuts. Upshift says its vaults have no exposure to rsETH. The incident is the first live stress test of Umbrella and highlights risks of whitelisting liquid restaking tokens as collateral.