Kelp DAO was attacked, with approximately $290 million in rsETH stolen. The hacker exploited a vulnerability in the rsETH bridge to mint and withdraw large amounts of rsETH, then used it as collateral to borrow funds across DeFi protocols—including Aave. Current price: $90.53. This caused $Aave to plummet from around $115 to $90, with virtually no meaningful rebound during the decline. From Aave’s recent post, it’s clear the focus is on deflecting blame onto rsETH and determining who should cover the $200 million in bad debt—a point where progress has stalled. The issue is that L2 protocols lack built-in insurance mechanisms; if responsibility is rigidly assigned, it could drag down the entire L2 ecosystem and associated protocols, further spreading risk. Aave’s core market utilization is now at 100% across the board, with billions in USDT and USDC locked up—liquidity has essentially dried up. Early large holders have already withdrawn, leaving remaining users trapped with their funds effectively frozen. The likely chain of responsibility is: KelpDAO > LayerZero > Aave. But the real pressure falls on Aave’s users and the broader ecosystem, as not only are funds inaccessible, but the liquidation system may also fail, allowing bad debt to continue growing. If no party steps in to cover losses, the outcome will likely be either distributed losses or direct user losses. Ideally, all three parties and the market would jointly inject liquidity to stabilize the system. But what’s unfolding now resembles a cascading failure of DeFi risk controls—with confidence already shattered.