Aave TVL Still Down 43% Four Months After KelpDAO Hack

Aave, one of crypto's largest lending and borrowing protocols, has yet to recover from the April 18 hack of KelpDAO. The value of all crypto assets held in its smart contracts remains 43% below its level at the time of the attack, and 67% below its 52-week high.

Just before the hack, KelpDAO users had entrusted $26.4 billion to Aave — already well down from the October 2025 peak of $45.9 billion. Today, the ecosystem holds a mere $14.9 billion worth of assets.

North Korean hackers looted KelpDAO in mid-April, and because Aave accepted KelpDAO tokens as collateral for loans, it was left nursing a nine-figure loss.

North Korea infected the industry

Although Aave itself was never hacked, according to its own report, the incident cost the protocol its long-held title as DeFi's biggest platform. Four months on, depositors still have cold feet.

LayerZero, the software provider for the KelpDAO bridge, blamed North Korea within 48 hours — an early call that outside investigators later confirmed.

KelpDAO accepts ETH deposits, stakes them on Ethereum's blockchain for yield, and issues a tradeable receipt token called rsETH. Staking receipt tokens of this kind are posted as collateral across DeFi lending markets, which is what tied Aave's balance sheet to a breach at a separate protocol. The thieves parked the stolen rsETH on Aave and borrowed real ETH against it, leaving Aave and fellow lender Compound with an estimated $246 million in combined bad debt.

Aave forcibly liquidated the attacker's positions, industry allies rebuilt the missing collateral, and by late May, Aave had declared every market back to normal. Even so, the dollar value of its liquidity pools never recovered, and Aave still sits about two-thirds below its October peak.

Why Aave's decline matters for DeFi

A non-custodial lending app, Aave ended 2025 with $55 billion in total value locked (TVL) — more than half of the DeFi lending sector's total. For a borrower, TVL is not an abstraction: it reflects the dollar-equivalent value of deposits and inventory that borrowers can draw on. A pool worth 43% less has that much less to lend, along with much higher volatility.

According to investigators at Chainalysis, North Korea's Lazarus Group was probably assisting the KelpDAO attackers, while LayerZero's own post-mortem attributed the operation to a North Korea-linked cluster known as TraderTraitor. Protos has also reported alleged on-chain links to the Bybit and BTC Turk hacks.

Aave never really recovered from KelpDAO

The Aave token fell roughly 20% in the day after the theft, from about $115 to below $92. It trades near $89 today, still slightly below its pre-hack level.

Within two days of the hack, Aave's deposits collapsed by more than $8 billion, and its stablecoin pools hit 100% utilization — leaving billions of crypto dollars effectively frozen, with no room for anyone else to withdraw stablecoins.

On April 27, Aave announced that a new coalition, DeFi United, had pledged enough ETH to restore rsETH's full backing. It then liquidated the attacker's positions on Ethereum and Arbitrum on May 6. Replacement collateral flowed into the bridge's reserves in tranches through late May.

The panic had not subsided even by May. TVL kept draining into June, bottoming near $11.9 billion before partially recovering. Aave now sits near $14.9 billion — down 43% from hack day. The rebound has restored only about $3 billion of the more than $14 billion decline between hack day and the June low, leaving TVL roughly $11.5 billion below its pre-hack level.

According to its own report, Aave's contracts, oracles, and liquidation mechanics worked exactly as designed, yet North Korea was still able to withdraw money using phony collateral. Whether TVL climbs back toward the $26.4 billion Aave held just before the hack remains the clearest measure of whether that technical all-clear is translating into returning deposits.