Fortunately I have no WETH anymore on Aave. But a lot of people do, and as of Saturday April 18, they may not be able to get it back anytime soon.

Here is what happened. KelpDAO, one of the main liquid restaking protocols on Ethereum, just got hit for roughly $292 million. The attacker exploited a vulnerability in their LayerZero-powered bridge, tricking the cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address. That is about 18% of rsETH's entire circulating supply, gone in a single transaction at 17:35 UTC.

But the drain was just the first half of the attack. The second half is what is now causing real systemic stress across DeFi.

The attacker immediately deposited the stolen rsETH as collateral on Aave V3 and borrowed a massive volume of WETH against it. Because the rsETH was no longer backed by anything, those positions are effectively unliquidatable. Aave is left holding bad debt. The same playbook was run on Compound V3 and Euler. Total bad debt across the three protocols is estimated above $236 million. Aave's WETH pool hit 100% utilization almost instantly, whales started withdrawing, and the AAVE token dropped sharply within hours.

This is the weaponization of DeFi composability. rsETH existed on Aave as collateral because it represented real staked ETH earning real yield. The moment Kelp's bridge was drained, the token became worthless paper, but Aave's smart contracts had no way to know that in real time. There is no circuit breaker. No grace period. The contagion moves at block speed.

The list of protocols that froze rsETH markets is long and still growing: Aave V3 and V4, SparkLend, Fluid, Lido's earnETH vaults. Ethena paused its LayerZero OFT bridges from Ethereum mainnet as a precaution even though it has zero rsETH exposure and stays above 101% overcollateralization. Everyone is moving defensively, which is the right call.

Now, which tokens are in danger?

AAVE already took a hit.

EIGEN, the EigenLayer token, is under pressure because rsETH is built on top of EigenLayer's restaking infrastructure.

ZRO, LayerZero's token, is already down, logically.. 

Pendle is another one to watch. The protocol sits directly downstream of rsETH through its yield trading pools on LRT assets. Any PT or YT position on rsETH-backed pools is now impaired.

Morpho is the most ambiguous case. The protocol has a $6.9 billion TVL and uses isolated markets, which means a bad debt in one rsETH market would not contaminate others by design. But Morpho is notably absent from the list of protocols that announced rsETH freezes, which either means they had no exposure or they have not reacted yet.

I am personally shorting some of these tokens on Asterdex, which offers perpetuals with deep liquidity and low fees. You can use my referral link if you want to try it: https://www.asterdex.com/en/referral/898200

The broader picture here is that 2026 is shaping up as the year DeFi composability risk becomes impossible to ignore. We have had the Drift exploit in April for $285 million, now KelpDAO for $292 million, and a dozen smaller protocols hit in between. Liquid restaking tokens were whitelisted as collateral on every major lending market because they represented a growing share of Ethereum's locked value. That assumption just broke in spectacular fashion.

Every major lending protocol is going to need to revisit its risk parameters for restaked assets. The days of treating LRTs as near-equivalent to ETH collateral are over.