hodler

7 May 2026, 09:08

KelpDAO exploiter’s wallets get liquidated on Aave

Aave DAO has voted to liquidate the frozen ETH funds from the KelpDAO hack. Aave has worked with KelpDAO, the LayerZero team, EtherFi, Compound, and other counterparties to recover as much funds as possible. The Arbitrum Governance process asked for approval to release 30,765.67 ETH frozen by the Arbitrum Security Council to become a part of a coordinated remediation effort. The end goal is to make all rsETH holders whole by restoring the wrapped token’s ETH backing in full. As Cryptopolitan reported , the ability to freeze and claw back funds has created a precedent in the crypto space, sparking controversy on the ability to compensate for earlier hacks. For now, the Arbitrum Security Council has only partially intercepted the hacker’s transactions. As a result of the hack, KelpDAO has also decided to move its cross-chain infrastructure to Chainlink’s CCIP ecosystem. Previously, KelpDAO considered the Layer Zero cross-chain tools to be one of the main reasons for the $292M exploit. 90% of Aave representatives voted for the liquidation According to Aave, a total of 1,600 addresses backed by 190M ARB tokens voted in favor of unfreezing the funds. Currently, the ETH is under the control of Arbitrum DAO. The decision achieved a strong approval of over 90% during the week of voting. Aave considers the decision a precedent for future recovery efforts in DeFi hacks. Stani Kulechov, the founder of Aave, announced that additional steps are coming to make Aave whole and compensate the bad loans. As part of the technical implementation plan for rsETH recovery, the attacker’s position has now been liquidated on both Ethereum and Arbitrum. This was an incredible technical effort by all contributors involved. Following up with the next steps shortly. https://t.co/KI9EOBXWU3 — Stani (@StaniKulechov) May 6, 2026 The Aave protocol also used its internal protection mechanisms against the hacker. After the exploit, some of the rsETH was used in attempts to take additional loans. However, when the token’s risk crossed a certain threshold, the hacker was liquidated. Despite this, Aave on Arbitrum estimated bad loans between $170M and $230M. Aave strives to recover normal lending Aave stabilized its value locked at above $15B following the initial outflow of $10B. Some of the leading vaults have improved their health, with utilization rates falling below 100%. The WETH lending vault has a utilization above 93%, while the USDT and USDC vaults sit at 92% and 91%. Aave stablecoin vaults have started normalizing their utilization and yield rates after the wave of withdrawals. | Source: AaveScan. The utilization rates signal the run to withdraw from Aave has ended, but the overall effect is lower lending activity, which may have to go through a long recovery. Lending in total has fallen by 35% in the past 30 days, while stablecoin liquidity has fallen by 46.3% for the past month, based on Aavescan data . Despite this, the average lending rate has normalized to 2.76%, while the borrowing rate sits at 4.08%, with variations between specific vaults. Despite the drop, Aave lending is healthier compared to the 2022 crash, and is still considered central to DeFi activity. Following the initial shock, the AAVE token stabilized at around $94, still showing weak signs of recovery despite the overall crypto market improvement. The protocol has retained its GHO tokens at over $538M, with no recent supply burned. If you want a calmer entry point into DeFi crypto without the usual hype, start with this free video.

7 May 2026, 04:00

Retail Capitulation Hits AAVE, But Smart Money Starts Positioning: Here The Post-Crisis Market Structure

Aave entered April 2026 as DeFi’s most trusted lending protocol. It is ending the month navigating the most damaging crisis in its history — one that did not require a single line of its own code to be broken. Related Reading: Ethereum Withdrawals From Exchanges Just Hit An 8-Month Low: Find Out What Investors Are Waiting For The attack began at Kelp DAO, where an attacker exploited a vulnerability in the rsETH bridge to drain approximately $292 million in stolen tokens. What followed was not an isolated protocol incident. The attacker deposited the stolen rsETH as collateral on Aave V3 and borrowed against it. Using fraudulent assets to extract real ones. Because Aave had accepted rsETH as legitimate collateral, the protocol had no mechanism to reject the deposits in real time. By the time the damage was visible, between $170 million and $230 million in bad debt had accumulated inside the system. The market’s response was immediate and severe. Users who had previously trusted Aave with their assets moved to withdraw. TVL fell by billions of dollars as confidence drained alongside the liquidity. The AAVE token, already under pressure from previous contributor departures, collapsed to $93.90. The protocol’s own smart contracts were never compromised. Its reputation, its liquidity, and its price were. In DeFi, where trust is the product, the distinction between a direct exploit and a collateral-triggered crisis offers less comfort than it might appear. Retail Is Selling. Whales Are Watching. The Bottom May Be Forming A CryptoQuant report tracking AAVE’s market structure on Binance reveals a picture that tells two different stories depending on which participants you are watching. The first story belongs to retail. Exchange reserves have surged sharply — a significant increase in AAVE being deposited onto Binance. Reflecting holders moving to the sell side at scale. The average spot order size has plunged to approximately $80 to $100, confirming that the selling activity is dominated by small participants reacting to the crisis rather than large holders making strategic decisions. When average order sizes collapse to that level, it reflects fear-driven liquidation rather than informed distribution. The second story is more nuanced. Amid the flood of small sell orders, big whale orders are appearing sporadically in the bottom zone — large, deliberate positions being tested at current price levels by participants whose behavior is the opposite of the retail panic surrounding them. These orders are not consistent or sustained enough to confirm a bottom. They are present enough to suggest that informed capital is beginning to evaluate the current level as an entry rather than an exit. Liquidity on Binance remains thin, which means selling pressure can move price more easily than it would in a deeper market. The conditions for a bottom are assembling gradually — retail exhaustion visible in the order size data, whale positioning visible in the sporadic large orders. Neither signal is definitive yet. Together, they describe a market in the early stages of transition from crisis to potential recovery. Related Reading: Bitmine Just Crossed $10 Billion In Staked Ethereum – 88% of Everything It Owns Is Now Locked In AAVE Stabilizes After Capitulation, But Trend Remains Fragile AAVE is attempting to stabilize around the $90–$100 range following a sharp capitulation phase that reset price structure across the chart. The breakdown in February marked a decisive loss of trend, with price collapsing through multiple support levels and accelerating into a high-volume selloff. That move established the current range as a post-crisis consolidation zone rather than a confirmed bottom. Since then, price action has shifted into compression. AAVE is trading below all major moving averages, with the 50-day acting as immediate resistance and the 100-day and 200-day trending downward above it. This alignment reflects a market still structurally bearish despite the short-term stabilization. Related Reading: XRP Liquidity Just Hit A Five-Year Low: Discover What Happens When A Market Gets This Thin The recent bounce attempts have lacked follow-through. Sellers reject each push toward the $105–$110 region, keeping supply active on rallies. At the same time, buyers absorb the downside near the $85–$90 zone, stepping in more consistently. This creates a tightening range, typically a precursor to expansion. Volume behavior supports this interpretation. The capitulation spike has not been matched by equivalent buying pressure, indicating that accumulation, if present, is gradual and not aggressive. A break above $110 would be the first meaningful shift in structure. Until then, AAVE remains in a fragile equilibrium. Featured image from ChatGPT, chart from TradingView.com

5 May 2026, 14:45

Tydro pauses all markets over oracle issues weeks after aiding Aave's exploit recovery

Tydro, the Aave-powered lending protocol on Ink with $247 million in deposits, halted all markets on May 4 after detecting problems with a third-party oracle provider. The shutdown comes barely two weeks after Tydro contributed to coordinated relief efforts for Aave following the $290 million KelpDAO exploit that affected the protocol. Tydro posted on X that it was “temporarily pausing all markets out of an abundance of caution following reports of issues with a third-party oracle,” adding that user funds remained safe. However, it did not provide a timeline for the restoration. How did Tydro move from rescuer to rescued? On April 23, Tydro and the Ink Foundation announced they were joining Aave and other ecosystem participants in a “coordinated DeFi relief effort” to help parties affected by the KelpDAO rsETH exploit and “support an orderly resolution for lenders and mitigate bad debt,” according to Tydro’s post at the time. That exploit, which saw around $290 million drained through uncollateralized rsETH tokens minted via a KelpDAO bridge vulnerability on April 18. The incident triggered over $15.1 billion in outflows from Aave over three and a half days. Aave saw its deposits fall from $48.5 billion to $30.7 billion as users fled to competing platforms such as Spark. Tydro, which describes itself as “a non-custodial lending protocol for onchain capital markets, powered by Aave and built on Ink,” now faces headaches of its own, even though it did not confirm if it was exploited or not. Currently, Tydro holds over $206.7 million in active loans and generated over $943,000 in fees over the past 30 days, per DeFiLlama data . Tydro’s markets remain paused after an oracle issue. Source: DeFiLlama. Has Aave recovered from the April exploit? Aave itself is yet to fully recover from the April exploit fallout. On the same day Tydro went dark, Aave LLC filed an emergency motion to vacate a restraining notice served on Arbitrum DAO on May 1 that “attempts to seize approximately $71 million in ETH belonging to victims of the April 18 exploit,” according to the protocol’s post on X. The plaintiffs who filed the restraining order claim the thief is linked to North Korea and the funds seized thereby already belong to North Korea, against whom they already have grievances. Aave disputes this position, stating, “A thief does not gain lawful ownership of stolen property simply by taking it, and the law is clear on this.” It wrote, “Those assets were recovered to be returned to users victimized in the April 18, 2026 exploit. Freezing them harms the very people this recovery effort is designed to protect.” Tydro users, on the other hand, are still in the dark on how long markets will remain frozen and whether the oracle issue has exposed any positions to liquidation risk. For now, all they have to go on is that the protocol said it is “actively investigating.” The smartest crypto minds already read our newsletter. Want in? Join them .

5 May 2026, 01:07

Aave challenges $71M freeze as DeFi recovery collides with North Korea claims

Aave, a major decentralized finance (DeFi) liquidity protocol, is asking a U.S. federal court to lift a freeze on roughly $71 million in ETH. The firm argues that the assets belong to its users, not to a suspected North Korean hacker. The funds are currently locked on the Arbitrum network. The dispute highlights growing tension between DeFi recovery efforts and creditors seeking to enforce longstanding judgments against North Korea. In a court filing dated May 4, 2026, Aave said the court-ordered freeze is blocking the return of assets recovered following the Kelp DAO rsETH token exploit. In the meantime, the company is demanding an immediate lifting of the freeze. If the freeze stays, it requires a minimum $300 million bond from the plaintiffs. “Since the exploit occurred, teams from the Aave Protocol community, the Arbitrum community, and others in the global DeFi community have been working tirelessly as part of an effort called ‘DeFi United’ to return the frozen assets and other value to those affected by the Aave Protocol incident. They aim to restore stability and security within both the Aave Protocol and other protocols in the decentralized finance ecosystem while also ensuring that similar exploits do not happen again,” said the memo. Recent developments suggest that lawmakers are closer than ever to resolving those disputes. A bipartisan breakthrough on stablecoin yield restrictions has removed one of the biggest obstacles to progress, with negotiators now working on final language that would allow crypto rewards tied to user activity while limiting interest-like payments on idle balances. The Kelp DAO rsETH token exploit raises doubt over the Blockchain technology This dispute originated from a cyber breach in April involving Kelp DAO, a prominent liquid restaking protocol on Ethereum . In this scenario, a hacker exploited a vulnerability in a cross-chain bridge connected to the rsETH token. Afterward, the hacker exploited Aave by using illicitly obtained assets as collateral to borrow roughly $230 million in ETH. Shortly after the incident, as previously reported by Cryptopolitan, the Arbitrum protocol seized 30,766 ETH, worth about $73 million. It then reserved the assets for recovery. Analysts say the initial expectation was for the recovered ETH—the first major batch post-hack—to be returned to the victims. Later, this endeavor evolved into “DeFi United” pending ETH unfreezing decisions and other protocol votes. Notably, DeFi United is an emergency coalition of major crypto protocols—including Aave, Lido, and EtherFi—formed in April 2026 to restore rsETH backing after a $292 million Kelp DAO exploit. In this case, the plaintiffs, who hold unpaid judgments against North Korea, indicated a high likelihood that the attacker is linked to the regime’s Lazarus Group. Based on their argument, the frozen assets should be considered North Korean property and seized. In their filing, the plaintiffs began by admitting that the accusations regarding North Korea could be valid. “However, AaveLLC strongly disagrees with the idea that these issues can be legally resolved by restraining and seizing assets belonging to innocent third parties—specifically, users of the Aave software protocol (the ‘Aave Protocol’), who are completely unrelated to any alleged wrongdoing and have no known ties to North Korea,” they said. Despite uncertainty regarding the culprit, the hack had immediate consequences. Panic withdrawals quickly drained key lending pools, leaving them with critically low balances. These sudden mass withdrawals left some users unable to withdraw their deposits. The filing noted that the funds were seized directly from Aave users. This statement challenges the claim that they are associated with any alleged wrongdoer. It also casts doubt on whether Arbitrum DAO qualifies as a legal entity. Meanwhile, Aave refused to be an official entity subject to the plaintiffs’ method of service. This claim could create legal hurdles. Can stolen crypto be recovered without harming innocent users? Aave argues that freezing the assets is not only a legal issue but is actively hindering recovery from the Kelp DAO exploit. At this point, the attorneys for the plaintiffs stated that the Restraining Notice against Arbitrum DAO was not intended to assist in recovering funds for Aave Protocol victims; rather, they noted, it served the opposite purpose. In a statement, the founder and CEO of Aave, Stani Kulechov, stated that, “A thief does not own what he steals.” He compared the situation to a thief stealing diamonds, to have them snatched back. “These funds belong to the affected users they were stolen from — end of story,” he said. There’s a middle ground between leaving money in the bank and rolling the dice in crypto. Start with this free video on decentralized finance .