Life on the same day: Aave hugged rsETH at nearly 200 million, and Spark withdrew. No damage

On 18 April, Kelp DAO was attacked at the cross-link bridge, where the attackers forged 11.65 million rsETH without endorsement of real assets, which was deposited in Aave and loaned WETH. Aave Guardian activated the emergency freeze within hours. Ave V3 and V4 face potential bad debts of approximately $195 million, estimated on the Lokonchain chain。

SparkLend。

It's not because Spark's team is smarter than Aave, it's not because they saw a loophole in the bridge. Spark's reasons for withdrawing from rsETH were written in the Governance Forum post three months ago and had nothing to do with the security of the bridge contract。

29 January 2026 is the core date of this document. On that day, Spark performed a governance operation called Spell that stopped the new supply of rsETH access. On the same day, the rsETH E-Mode of Aave officially came online and allowed users to borrow WETH as collateral for rsETH, with a maximum mortgage rate (LTV) of 93%。

One exit, one expansion, all on the same day。

Spark's withdrawal decision, starting with a governance post submitted by Phoenix Labs (Spark's Ecological Enforcement Agency) on 16 January 2026. The reason for the withdrawal is clear, the use of rsETH is low, almost all of which comes from the same wallet (linked address 0xb99a), and the holder of the wallet has expressed a willingness to use alternative collateral such as wstETH or weETH. The governance post reads as follows: "The exit of rsETH can improve the safety margin of SparkLend and increase the risk-adjusted returns." This is a cyclical asset clean-up, and the same batch exits the entire market of tBTC, ezETH and Gnosis Chain on the grounds of "low usage"。

Aave's expansion was decided earlier, from the ACI proposal of November 17, 2025 (Aave Chan Initiative, governance proposal body led by Marc Zeller). The motivation for the proposal was clear: "Recovering WETH utilization, expected to attract a billion dollars in rsETH. In January, Chaos Labs completed the identification of risk parameters, establishing E-Mode LTV at 93 per cent and liquidation threshold at 95 per cent. The main actors in decision-making are ACI, Chaos Labs, LlamaRisk and Aave community voters. This is a multi-driven expansionary decision, not an institutional failure。

Three months later, the market gave results。

Aave currently has approximately $50 million available for the Umbrella insurance scheme, covering only 25 per cent of the potential bad debts of approximately $195 million this time. The order of absorption of the loss is: aWETH pledge is borne first, followed by a prorated share of the WETH depositor, followed by stkaAVE and DAO Treasury. Aave TVL fell from $26.4 billion to $19.8 billion, including panic withdrawals. The USDT market utilization rate reached 100 per cent in hours, with additional borrowing of about $300 million。

Spark is currently frozen at the rsETH market in SparkLend with a residual value of $373 million, or 15.32 rsETH. The wallet, 0xb99a, has been moved almost entirely to wstETH and weETH after the ban on new supplies on January 29th, fully consistent with the governance post projections。

Sam MacPherson (@heconaut) co-founder of Spark warned on April 19 that an agreement claiming no risk exposure to rsETH does not mean that there is no real risk exposure, and indirect exposure still exists if the user has collateral in the affected lending market. Spark has no direct loss, but indirect risk is still being assessed。

The two agreements took the opposite decision on the same day, not to say that Spark and Aave had made the right decision and that the starting point for the two systems was completely different。

Spark's wind-control logic is that the trigger is “whether marginal costs exceed marginal gains”, the usage rate is below the threshold, the single-user concentration is exceeded, the risk-adjusted returns are not achieved, and the asset is on the exit list when any hit is hit. This is a proactive, efficiency-oriented tightening mechanism, regardless of whether the asset itself has security risks。

Aave's logical trigger is "market growth opportunities". WeTH is under-utilized, rsETH markets are large enough for E-Mode to attract incremental funds. From this entry point, the parameters are oriented towards expansion, with 93 per cent of the LTV, a loose supply ceiling, and a combination of governance actors。

The two agreements answer completely different questions: "The value of this asset is not worth holding" or "How much increase can this asset bring?" Both sets of questions, before a risk event was triggered, were reasonable commercial logic and only when a decision was triggered。

There's another layer of support。

Sam MacPherson, in an X post that announced "exit rsETH" on April 19, said: "SparkLend has a maximum deposit and loan at a speed limit. Its predictive mechanism also uses a three-way median. This phrase points to two other lines of defence for the Spark wind control system。

One is physical restraint during operation. Rate-Limited Supplement Cap limits maximum supply in unit time, Borrow Cap limits maximum lending. These two designs mean that even if Spark did not quit rsETH at that time, the attackers could not put $292 million rsETH in a one-time way, as they did in Aave, and the scale of the loss would be reduced by a rigid cap。

The other line is in the price information layer, the 3-square-digit predictor machine, taking the median of the three independent price sources: Chronicle, Chainlink and RedStone, with extremes falling to the bottom of the Uniswap TWAP. A single price source is manipulated and does not affect the triggering of liquidation. By contrast, Aave faced a window of exposure due to the price lag of the prognosis machine during the incident, a difference at the design level rather than a failure at the implementation level。

The three lines of defence are designed along the same lines: instead of relying on early identification of specific risks, they limit the maximum exposure to any single risk event at the system level。

The final loss figures depend on Kelp DAO ' s allocation of loss. There are currently three options: full-chain rsETH socialization losses (reduced scale of bad debts), L2 rsETH sole costs (main network Aave bad debts unchanged), and snapshot rollback (very difficult to operate). That number will be answered in the coming weeks。

But the results of the two policy-making philosophies can already be quantified, with a gap of approximately $195 million, with the same trigger date, written in the governance operation of the same day。