InvestigationEthereumAaversETH

The week $12 billion left Aave

The hack itself is well documented. What it did to everyone else on Aave is not. We followed every deposit, withdrawal and loan on its main market, hour by hour, through the week after.

By · Blockchain IntelligenceOn-chain figures verified September 24, 20267 min read
At a glance
On April 18, 2026, someone pulled 116,500 rsETH out of its bridge and borrowed against it on Aave within minutes. The lender later wrote off $124.5 million. That loss was small next to what came after. Within two hours, depositors began to leave, and in one week they took a net $12.4 billion out of Aave's main market. Borrowing stablecoins got four times as expensive. Hardly anyone was liquidated. Five months later, deposits were still a fifth below where they had been.
$12.4B
Net taken out of Aave's main market, April 18 to 24
$2.1B
Taken out in the single hour after the borrowing
14%
Cost to borrow USDC or USDT per year, up from 3.5%
$1.5M
Loans liquidated there that week
Key findingsEach line has its own share link
  1. $12.4B

    Net taken out of the main market in the seven days from April 18, 2026. The week before, it was $0.4 billion.

  2. $2.1B

    Taken out in the 19:00 UTC hour on April 18, less than two hours after the rsETH-backed borrowing. Earlier that day no hour reached $50 million.

  3. 75x

    The run against the loss: $12.4 billion left, while Aave and Compound together took $164 million of bad debt.

  4. 14%

    Cost to borrow USDC and USDT for four to five days, up from about 3.5%.

  5. $1.5M

    Liquidated in the run week. Borrowers paid down $4.1 billion of loans instead.

  6. 78%

    Of March's deposits back by September 22, after a low in June.

01 · The triggerA bridge hack, in brief

Aave is the biggest lender on Ethereum, with more than half of all the money lent there, as our look at Ethereum lending since 2021 shows. People deposit crypto to earn interest, and others borrow against crypto of their own. In April 2026 a hack at another project sent a shock through it.

rsETH is Kelp DAO's token for restaked ETH. On April 18, an attacker fooled the bridge that carries rsETH between chains into paying out almost $300 million of it on Ethereum, as CoinDesk reported. The attacker had put nothing in to get them.

On Ethereum the attacker moved fast. The release landed at 17:35 UTC. Within seven minutes the rsETH was split across seven wallets. Two of them posted it on Aave and borrowed WETH against it, and another did the same on Compound.

LenderrsETHBorrowedLoss
Aave53,40052,835 WETH$124.5M
Compound17,42611,963 WETH*$39.2M
April 18, 2026, Aave v3 and Compound v3 on Ethereum. *Plus 3,906 wstETH. rsETH: collateral still posted after the borrowing. Loss: written off by Aave on May 6, 2026 and taken by Compound's reserves on May 9, 2026.

Aave froze its rsETH markets within hours. In May both lenders closed the loans, valuing the attacker's rsETH at close to nothing, and wrote them off. That was the direct bill, about $164 million. The bigger shock came from everyone else on Aave.

02 · The first hoursDepositors start to leave

Withdrawals from Aave, hour by hourAll assets on Aave v3's main market, April 18 00:00 to April 19 12:00 UTC, in millions of dollars$0M$500M$1,000M$1,500M$2,000M$2,500M00:0003:0006:0009:0012:0015:0018:0021:0000:0003:0006:0009:00Apr 18Apr 1917:35 rsETH released, 17:40 borrowed against$2.1B

Before the hack, the market was quiet that Saturday. No hour saw even $50 million leave. Then, in a single hour that evening, less than two hours after the borrowing, $2.1 billion left.

On April 18 and 19 together, $8.3 billion went out, against about $1 billion on a normal day the week before. At that point nobody knew how much bad debt the lender would be left with.

03 · The weekMoney out, rates up

April 2026 on Aave: money out, rates upBars: deposits minus withdrawals each day, billions of dollars. Lines: cost to borrow, percent per year (APR).Net outflowUSDT borrow rateWETH borrow rate-$4B-$3B-$2B-$1B$0B$1B0%4%8%12%16%Apr 1Apr 8Apr 15Apr 18Apr 22Apr 29

The outflow ran for a week. Over those seven days, deposits minus withdrawals came to minus $12.4 billion, about thirty times the week before. That was Aave's TVL walking out the door.

A lender's rates rise as its cash runs low. Here the cost to borrow USDC and USDT jumped from about 3.5% per year to 14%, and stayed there for four to five days. WETH went from 2.3% to 8.4%.

AssetBeforePeakDays
USDC3.5%14.0%4
USDT3.5%14.0%5
WETH2.3%8.3%2
Aave v3 variable borrow rate, percent per year (APR), at the end of each UTC day. Before: highest April 10 to 17. Days: days at or near the peak.

04 · Who leftStablecoins first

AssetNet out
USDT$2.49B
wstETH$1.76B
USDC$1.39B
weETH$1.06B
WETH$1.02B
USDe$976.98M
WBTC$890.97M
cbBTC$859.94M
Others$1.92B
All$12.35B
Deposits minus withdrawals on Aave v3's main market, April 18 to 24, 2026, at each day's price.

Stablecoins made up half of what left, led by USDT and USDC. ETH in its various forms and wrapped bitcoin followed. Some of this was ordinary depositors taking cash out. Some was borrowers unwinding. They repaid their loans and took their collateral with them, and loans on the main market shrank by $4.1 billion in the same week.

05 · No cascadeHardly anyone was liquidated

A run on a lender can set off a spiral of forced sales. This one did not. ETH's price fell no more than 7% that week, and loans there were liquidated for just $1.5 million in total. Nearly all of the money that left, left by choice.

Those who stayed paid for it. Anyone borrowing stablecoins paid four times the usual rate for most of a week.

06 · AfterFive months on

Deposits on Aave's main market, month end, 2026All assets at month-end prices, in billions of dollars. September is the 22nd.$0B$15B$30B$45B$41.1B$33.7B$33.0B$20.3B$18.5B$16.7B$19.7B$24.5B$25.8BJanFebMarAprMayJunJulAugSep

Deposits on the main market were worth $33.0 billion at the end of March, already down from $41.1 billion in January as ETH fell. In April they dropped to $20.3 billion even though ETH rose, so that fall was money leaving. They hit $16.7 billion at the end of June, when ETH was near its low for the year. By September 22 they were back to $25.8 billion, still about a fifth below March, with ETH worth almost a third more than it was then.

These are month-end values, so they move with prices. The outflow figures above do not, because each day's flows are counted at that day's price. A separate rsETH incident in September, a Safe module drain, had nothing to do with the bridge.

07 · The billThe loss and the run

So what did the rsETH hack cost Aave? The hack itself left Aave and Compound on Ethereum with about $164 million of bad debt, the most booked on Ethereum's lenders in our data since 2021. The run it set off moved about 75 times as much money out of Aave in a week. It made borrowing four times as dear, and five months later the deposits still had not all come back.

For Aave, the hack was the smaller shock. The fear that followed it was the bigger one.

08 · How we measuredWhat we counted, and what we left out

We read every deposit, withdrawal, loan and repayment on Aave v3's main market on Ethereum from its own on-chain events and valued each at that day's price from Aave's oracle. Times are Ethereum block times in UTC. We traced the rsETH from the bridge to the lenders with public transfer logs.

We did not measure other chains, the lender's other markets, or where the attacker went after borrowing. The hack itself, and who was behind it, are covered in the reporting we link.

09 · The recordThe contracts behind the numbers

ContractAddress
Aave v3 Pool0x8787…a4e2
rsETH token0xa129…e5a7
rsETH bridge adapter0x85d4…8ef3
First receiving wallet0x8b1b…0d3b
Aave borrower0x1f4c…adef
Compound borrower0xeba7…129b
Compound v3 WETH0xa175…ae94
Compound v3 wstETH0x3d0b…afe3
Run it yourself

Watch a lender in plain English

Every figure above came from data anyone can query. The Bitquery MCP server puts it behind an AI assistant, so you can ask how much left a lender in the last hour, what it costs to borrow a stablecoin right now, or where a wallet sent what it borrowed, without writing the query yourself.

Track deposits and withdrawals on Aave by the hourWatch borrowing rates on any assetFollow a token from a bridge to the lendersSee who is being liquidated, and for how much
Explore Bitquery MCP →Figures measured September 24, 2026, against Bitquery's Ethereum data, April 1 to September 22, 2026. Written by Bitquery Research; AI tools ran the queries and drafted the text, and every figure was worked out again from the data before publishing.
Scope, limits and attribution

This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice.

The findings describe activity on Aave v3's main market and Compound v3 on Ethereum, measured from on-chain events and valued at daily oracle prices. Other chains and markets are not measured. Month-end deposit values move with prices.

References to Aave, Kelp DAO, Compound, Euler and any other party describe contract state and on-chain activity. Wallets are identified by address only; nothing here states who controls them. Details of the hack itself come from the linked reporting.

Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from the use of this article.