Restaking's Risk Just Got Priced. Aave Pays the Bill.

Today we're in DeFi.

And somewhere, right now, someone is hammering F5 on a withdrawal page going nowhere.

Coffee at the ready…

The biggest Aave hack of 2026 wasn't an Aave hack.

Picture a depositor right now: they lent USDC into Aave for a sleepy 4% yield, woke up Sunday, tried to withdraw — and the screen said no. The pool is at 100% utilisation. Their money is still there.

They just can't have it.

The cause:

A $292 million heist of a token Aave doesn't issue, on a bridge Aave doesn't run.

The result:

$8.45 billion fled the protocol in 48 hours, per DefiLlama.

The cleanest robbery of 2026 didn't need to break Aave. It just needed Aave to believe in restaking.

Restaking is the financial equivalent of double-renting your apartment.

You stake ether once on Ethereum for yield. Then you stake the receipt for the stake on a platform called EigenLayer to earn more yield. Then you take the receipt — a "liquid restaking token" called rsETH — and use it as collateral on Aave to borrow real money. Same ether. Three risk layers.

The industry calls it innovation.

Defenders say that one bridge breaking doesn't condemn the concept.

Fair point — except every restaking token depends on a bridge somewhere, and Saturday proved DeFi's biggest lender prices the risk at zero.

On Saturday, the attacker exploited Kelp DAO's LayerZero-powered bridge and walked away with 116,500 rsETH — about 18% of the entire supply.

They deposited it as collateral on Aave V3. Then they borrowed roughly $196 million in wrapped ether, backed by fake collateral. Aave's code worked exactly as designed.

The design was the problem.

Founder Stani Kulechov said Aave's contracts weren't compromised.

True. Also irrelevant. Aave just collected $196 million in bad debt because its risk model trusted rsETH to hold its peg.

The model didn't ask:

What if the lockbox holding rsETH's reserves gets emptied on a Saturday by someone with a stolen verifier key?

The contagion was instant.

SparkLend and Fluid froze their rsETH markets. Lido paused its earnETH product. Morpho shut its Arbitrum bridge. Across DeFi, $13.2 billion in deposits walked out in two days. Aave lost its crown as the largest DeFi protocol on Sunday morning.

The trapped USDC depositor still hasn't been able to withdraw their funds.

Pro: Aave V3 and V4 contracts are intact. Bad debt is roughly 1.1% of a $17.82B loan book. The Umbrella backstop exists. This is the system absorbing a hit, not breaking under one.

Con: A "decentralised" lender just lost a third of its deposits to a bridge it doesn't run, accepting collateral it didn't issue, with risk models nobody stress-tested for the obvious failure mode.

Our read: The damage is survivable. The repricing isn't. DeFi spent two years pricing bridge risk at zero, and the invoice landed over the weekend.

[Report] CoinDesk — "Aave records $6 billion TVL drop as Kelp hack exposes structural risk"

Wrapped ether is 39.49% of Aave's entire $17.82 billion loan book — the exact pair the attacker hit.

Why it matters: The hack didn't find a corner case. It walked through the front door of the busiest aisle.

$5.1 billion of stablecoins are locked. Can't withdraw.

[CoinCentral]

CoinDesk — Trapped depositors borrowed $300M against their own frozen stables at brutal rates just to get something liquid. Bank runs go digital.

TheStreet — DeFi has lost $605M to 12 separate exploits in April alone. Kelp is just the loudest one.

CoinDesk — Developers are quietly admitting the real flaw: "modular" cross-chain security with no minimum standards. The next bridge is the next bank run.

You can read all our back issue newsletters for free here.

For the love of coffee, see you tomorrow!

Enjoy your Tuesday, keep it caffeinated.

Thanks for reading!

Are you subscribing?

Join your crew of caffeinated sceptics today.

Be sure to get your daily Curse and Coffee fix by hitting the button below.

Open Monday to Friday.

Read Friday’s newsletter about Cursor’s $50 billion valuation here.