Aave has restored normal wrapped Ether borrowing across six of its largest deployments, reversing the emergency safeguards put in place after April’s $292 million rsETH exploit. In a Sunday post, Aave founder Stani Kulechov confirmed that loan-to-value ratios for WETH collateral on Aave V3 Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle, and Linea were reinstated to pre-incident levels, allowing users to once again borrow against WETH and execute collateral or debt swaps. The move signals that the immediate systemic risk from the Kelp DAO bridge attack has eased, even as legal disputes over frozen Ether tied to the exploit remain unresolved.
A liquid restaking token (LRT) is a tradable token that represents staked Ether which has been re-deployed to secure additional networks, allowing holders to earn layered yield while keeping their position liquid. Kelp DAO’s rsETH is one of the largest such tokens, and its bridged version was widely used as collateral on Aave V3 before the exploit.
Key takeaways
- Aave restored WETH borrowing across six V3 markets on May 17, returning loan-to-value ratios to pre-incident levels of 80.5% on Ethereum Core, 84% on Ethereum Prime, 80% on Arbitrum, 80% on Base, 80.5% on Mantle, and 80% on Linea.
- The April 18 exploit drained roughly $230 million in WETH from Aave after attackers minted about $292 million in unbacked rsETH through Kelp DAO’s LayerZero bridge adapter.
- The DeFi United recovery coalition, which includes EtherFi, Lido, Mantle, and Ethena, has covered most of the rsETH backing shortfall, with more than 95 percent of unbacked tokens now recovered.
- Aave’s total value locked sits at roughly $14.8 billion as of May 18, down from nearly $23.5 billion in March, per DefiLlama data.
Published: May 18, 2026, 16:00 UTC
What changed and why it took a month
The emergency restrictions were introduced on April 18, hours after attackers exploited a LayerZero-powered bridge tied to Kelp DAO’s rsETH, a yield-bearing token linked to restaked Ether. The attackers minted approximately 152,577 unbacked rsETH on remote chains and used those tokens as collateral on Aave V3 to drain wrapped Ether liquidity, generating roughly $195 million in bad debt for the protocol, according to risk firm LlamaRisk’s analysis published in Aave governance.
Aave governance voted on April 24 to commit 25,000 ETH from the DAO treasury to the broader DeFi United recovery initiative, an ecosystem coalition that pulled together pledges from EtherFi, Lido, Mantle, Ethena, Ink Foundation, BGD Labs, and others. Mantle separately committed a credit facility of up to 30,000 ETH. Kulechov said the WETH freeze was lifted only after recovery efforts progressed far enough that user risk no longer required the emergency caps.
Impact on lenders, borrowers, and the broader market
The restoration matters because WETH is the most-used collateral asset on Aave, and the emergency caps had forced sophisticated borrowers to either close positions or accept reduced borrowing power for nearly a month. With LTVs back to pre-incident levels, users can again open higher-leverage positions, run collateral swaps, and execute liquid staking strategies that depend on borrowing WETH.
The exploit has reshaped Aave’s footprint. DefiLlama data shows Aave’s total value locked fell from roughly $23.5 billion in March to $14.8 billion as of May 18, a drop of more than $8 billion. Even with WETH borrowing restored, rsETH itself remains frozen across Aave V3 and V4. Kelp DAO has announced it will discontinue rsETH bridging on Optimism, HyperEVM, Unichain, Avalanche, and MegaETH after June 15, charging holders a 100 USDC per-address fee to recover funds after that date.
For lenders who exited during the freeze, the question now is whether to return. The protocol’s risk model held under stress, but only because the DAO and its coalition partners absorbed the shortfall. That backstop is unlikely to scale to a larger event without changes to how collateral risk is assessed.
The legal dispute over 30,765 frozen ETH
A separate fight is playing out in court. The Arbitrum Security Council froze 30,765 ETH, worth roughly $71 million, on April 21 after blockchain analytics firms linked the funds to wallets associated with the exploit. On May 9, Judge Margaret Garnett of the Manhattan federal court modified an earlier restraining order to allow a governance-approved transfer from the Arbitrum Security Council wallet to an address controlled by Aave LLC, while protecting voting delegates from personal liability.
The transfer has not happened yet. Law firm Gerstein Harrow LLP, representing families pursuing unpaid terrorism judgments against North Korea, argued in court filings that the assets could constitute property tied to the Lazarus Group, the North Korean state-backed hacking unit that multiple blockchain analytics firms have attributed the rsETH exploit to. No court has formally ruled on that attribution as a legal fact. Aave is treating the Ether as user property; the judgment creditors are arguing it belongs to the attackers.
What comes next
Three things are worth watching. First, whether Aave governance adopts a structured collateral risk framework that prevents another LRT or bridge-dependent asset from being listed at 90%-plus LTV without an independent risk review. A temp check proposal for tier-based LTV reductions and wrap-depth eligibility limits is already moving through Aave forums. Second, whether the Arbitrum Ether transfer clears the court process, which directly affects how much of the DAO’s 25,000 ETH commitment is recovered. Third, whether TVL recovers as borrowers regain confidence, or whether the loss settles in as a permanent re-pricing of trust in cross-chain collateral.
Frequently asked questions
What is rsETH and why was it used as collateral on Aave?
rsETH is a liquid restaking token issued by Kelp DAO that represents Ether staked through EigenLayer. It pays holders restaking yield while remaining transferable, which made it attractive as collateral on Aave V3, where users borrowed WETH against it to run leveraged staking strategies.
How did the April 18 exploit work?
Attackers exploited a vulnerability in the LayerZero adapter that backed rsETH across chains, breaking the cross-chain invariant between locked Ether and remote-chain mints. They minted approximately 152,577 unbacked rsETH, then used those tokens as collateral on Aave V3 to borrow real WETH, draining roughly $230 million from the protocol.
Is it safe to borrow WETH on Aave again?
WETH borrowing has been restored to pre-incident parameters, which Aave’s governance and risk service providers signed off on. The rsETH and wrsETH markets themselves remain frozen, and Kelp DAO is winding down rsETH bridging on several networks. Each user should review the current parameters on the markets they use.
