rseth

Aave experienced approximately $8.45 billion in fund withdrawals after the KelpDAO's rsETH cross-chain bridge was attacked in April 2026, but the core functions of the protocol did not fail, successfully completing one of the largest liquidity stress tests in DeFi to date. This crisis originated from the attack on KelpDAO's LayerZero cross-chain bridge, resulting in approximately $292 million in rsETH being stolen, raising concerns in the market about the collateral value and solvency of rsETH.As rsETH is widely used as collateral in protocols like Aave, the risk quickly spread, leading to concentrated withdrawals by users, with some market utilization reaching 100% at one point, causing some users to be unable to withdraw funds immediately. In the face of liquidity tightening, the Aave risk management team initiated emergency freeze and parameter adjustment mechanisms to limit the spread of risk.Aave founder Stani Kulechov viewed this incident as proof of the maturity of DeFi, believing that the protocol continued to operate as designed under extreme pressure, demonstrating the resilience of an on-chain transparent, rules-driven system. However, several independent analysts pointed out that while Aave avoided a systemic collapse, the event exposed that the DeFi lending system still has concentration risks, liquidity risks, and contagion risks arising from high interconnectivity between protocols. The behavior of large borrowers could have an impact on the overall stability of the system that exceeds model expectations.Aave currently controls risk through multiple protective measures such as loan-to-value (LTV) limits, liquidation thresholds, supply caps, borrowing limits, Isolation Mode, E-Mode, and governance mechanisms. These mechanisms played a role during this crisis, but observers believe that the governance response speed and risk models still need further optimization to cope with future unknown systemic shocks.Analysis suggests that this incident indicates that DeFi protocols can withstand large-scale runs without external assistance, but a single stress test cannot fully prove system safety. As the composability between protocols continues to strengthen, an issue with an external asset or cross-chain bridge could still quickly evolve into a liquidity crisis for the entire ecosystem.

Regarding the attack on the Kelp rsETH LayerZero V2 bridge that occurred on April 18, Aave released a post-incident investigation on the X platform, emphasizing that the exposure was primarily due to third-party bridge infrastructure rather than the protocol itself. The attacker executed an RPC poisoning attack targeting a single validator of LayerZero, forging a cross-chain message. This led to the release of 116,500 rsETH on the Ethereum side without actual destruction on Unichain. The attacker subsequently deposited the stolen rsETH into Aave V3 (Ethereum Core and Arbitrum), borrowing approximately 82,650 WETH and 821 wstETH.The Aave Protocol Guardian and Risk Steward immediately implemented protective measures for the rsETH and WETH reserves. Currently, the WETH and rsETH markets in the affected V3 deployments are operating normally. The rsETH held by the attacker on Arbitrum has been destroyed, the LayerZero OFT adapter has been fully recharged in five batches, rsETH support has been fully restored, and Kelp has reopened the withdrawal, bridging, and claims functions for rsETH. The WETH LTV in the affected markets has been reset to pre-attack values, and Aave V3 is fully operational across all markets except for rsETH.The Arbitrum DAO has voted to authorize the transfer of frozen ETH to Aave LLC, and it is currently awaiting on-chain execution. The court is still reviewing the substantive content of the injunction, and Aave LLC will continue to comply with the injunction during the court's deliberation. Ongoing projects include: the Aave risk framework from Llama Risk, the bridging assessment framework, the release of evaluation reports for currently live assets, on-chain execution of Arbitrum DAO votes, and the court's review of the injunction.

Kelp DAO announced on Monday that after losing $293 million due to an attack by North Korea's Lazarus Group on April 18, rsETH has been fully restored after five weeks of repairs. Kelp DAO stated that the final batch of 20,373.7 rsETH has been sent to the LayerZero smart contract responsible for cross-chain transfers, officially concluding the operational phase of the rsETH recovery plan.Multiple crypto protocols contributed funds through the DeFi United initiative to assist in restoring the support for rsETH. The first batch of 25,000 rsETH was transferred on May 13, and withdrawals were reopened the next day. Currently, minting, redemption, and reward operations are all functioning normally. This attack caused a chain reaction in the DeFi lending market, with the attacker borrowing WETH using a large amount of stolen rsETH as collateral on Aave, resulting in Aave incurring $190 million in bad debt. The TVL dropped from $26.4 billion to below $14 billion and has since remained in the range of $13.9 billion to $15.1 billion without showing signs of recovery. In April, there were 25 crypto hacking incidents, resulting in total losses of $630 million.

According to official news, KelpDAO stated that the last batch of 20,373.72 rsETH has been transferred to the rsETH OFT adapter earlier, thus completing the operational part of the rsETH recovery plan. KelpDAO also attached the relevant transaction information.

Kelp stated on platform X that it has collaborated with multiple DeFi protocols to complete the liquidation of the attacker’s positions, and the recovery process of rsETH has made significant progress. Among them, Compound has participated in coordination multiple times over the past four weeks and provided about 3,000 ETH in support, while jointly completing the liquidation with Aave, recovering a total of approximately 17,426.2 rsETH. Euler Finance has liquidated the attacker’s positions within its protocol and plans to return the excess ETH to the DeFi ecosystem fund.

On-chain analyst Tom Wan posted on the X platform, stating that the current ETH utilization rate has fallen below 90%, and the lending APY has dropped to 1.9%. Since the rsETH LayerZero cross-chain bridge was attacked, the deposit scales of wstETH and weETH have decreased by approximately $1.2 billion and $1.76 billion, respectively.As the wstETH/weETH circular leverage strategy returns to profitability, the market's focus shifts to whether the demand for ETH circular leverage will return or if funds will continue to observe or flow to protocols like Spark and Morpho.

Kelp announced on platform X that to ensure the security standards of rsETH and optimize network integration, cross-chain support for rsETH on multiple networks will be stopped after June 15. The affected networks include Optimism, Manta, Mode, Blast, Scroll, X Layer, zkSync, Zircuit, Swellchain, Hemi, Berachain, Sonic, HyperEVM, Unichain, TAC, Avalanche, Plasma Stable, MegaETH, Monad, and Movement.Kelp reminds users holding rsETH on the above chains that they need to bridge back to the Ethereum mainnet before June 15. After June 15, asset recovery can still be requested, but each address will need to pay a fee of 100 USDC. The specific process will be announced as the deadline approaches.

Aave founder Stani Kulechov posted on the X platform that the next step of the rsETH technical recovery plan has been completed, and the loan-to-value (LTV) ratios of WETH loans across all affected networks have been restored to pre-event levels. Users can now again borrow on Aave using WETH as collateral, including through collateral and debt swaps.According to the Aave announcement, this recovery involves network deployments such as Aave V3 Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle, and Linea.

Kelp announced on platform X that the rsETH protocol has fully resumed normal operation, and the related functions have been re-launched on the mainnet and all Layer 2 networks, with the overall system status restored to normal levels. The rsETH exchange rate has been updated, accounting for all staking reward earnings accumulated during the suspension period. Meanwhile, EIGEN rewards are now open for distribution to rsETH holders, covering the entire suspension period.In addition, the deposit and withdrawal functions have been restored on the mainnet and Layer 2 networks, and the rsETH asset support status has been fully restored to 100% backing. The official emphasized that the current rsETH has achieved complete and sufficient support on the mainnet and L2 networks, and all operational processes have returned to normal.

The Compound Foundation stated that, after closely collaborating with the Aave and KelpDAO teams, the relevant positions of the rsETH exploiters in WETH and wstETH Comet have all been liquidated over the weekend, and all rsETH held by the attackers has been transferred to DeFi United. Compound noted that the swift action effectively mitigated market risks and protected the safety of the protocol's suppliers and reserve funds.Compound also updated that the transfer restrictions for Ethereum WETH and wstETH Comet have now been lifted, and all Comet markets have resumed normal operations. The protocol stated that the top priority remains ensuring the overall safety of the platform and thanked the Aave and KelpDAO teams for their collaboration during the incident handling process.

Aave stated that the first batch of rsETH has been transferred to LayerZero's OFT adapter, and cross-chain operations for rsETH between the mainnet and various L2s have been reopened.This progress means that the previously affected rsETH cross-chain channels have been restored for use, covering the Ethereum mainnet and L2 networks.

Aave stated that the first steps of the rsETH technical recovery plan have been completed, which includes the destruction of the rsETH held by the attacker on Arbitrum. In the coming days, stakeholders will gradually replenish funds to the LayerZero OFT adapter and restart rsETH-related operations in phases.Kelp previously stated that it has completed a series of rsETH endorsement recovery steps with Aave, planning to gradually inject 117,132 rsETH from the Aave Recovery Guardian and Kelp Recovery Safe into the LayerZero OFT adapter on the Ethereum mainnet.

Aave posted on platform X that the second phase of the rsETH event recovery technical plan has made progress. The 8 positions of the hacker on Aave V3 have been liquidated, and the recovered rsETH collateral has been handed over to the recovery custodian. The Arbitrum DAO has passed a proposal to return the previously recovered $71 million ETH.In response to the plaintiff's application for fund seizure, the judge has approved Aave LLC's proposal, allowing the transfer of the $71 million ETH to Aave LLC through on-chain voting by the Arbitrum DAO. Subsequent plans include destroying rsETH on Arbitrum and restoring the rsETH reserve. Once the reserve is restored, withdrawals will be reopened, and the WETH LTV on the Aave V3 Ethereum mainnet will be reinstated.

The Mantle community has authorized the Mantle Treasury to provide a loan of up to 30,000 ETH to the Aave DAO through proposal MIP - 34, to address the bad debt impact caused by the rsETH cross-chain bridge security incident on Aave V3.According to the proposal, the loan term is up to 36 months, with an interest rate of LIDO + 1% annualized, and the borrower can repay early without penalty. In terms of risk control, Mantle will have priority security rights over the relevant collateral assets, and Aave will also provide additional collateral in the form of Aave tokens and protocol revenue worth no less than $11 million, and will delegate 130,000 Aave tokens to Mantle for governance participation.

Mantle token holders have approved a credit line of up to 30,000 ETH (approximately $68 million) to Aave DAO through the MIP-34 proposal. This move aims to help address the potential bad debt issues arising from the rsETH attack incident in April, which is estimated to have caused bad debts between $123.7 million and $230.1 million.The proposal was passed in a seven-day Snapshot vote, authorizing the Mantle Foundation to negotiate and execute the final loan agreement with Aave DAO. The final implementation of this credit line still depends on Aave executing its recovery plan and finalizing specific terms.A Galaxy Research report noted that the rsETH attack incident had put Aave's WETH market under continuous strain, with the utilization rate remaining above 99% for 12.7 consecutive days. As of May 8, the utilization rate of Aave Ethereum V3's WETH market has dropped to about 91.6%, indicating some relief in market pressure.

According to The Block, the on-chain lending platform Aave has completed the liquidation of the remaining rsETH positions of the Kelp DAO attacker as part of the previously announced recovery plan.The collateral obtained from the liquidation will be transferred to a multi-signature address "Recovery Guardian" managed by the DeFi United initiative, which is working to restore the asset backing of rsETH and compensate affected users. This process marks one of the final stages of the community's efforts to make up for the $292 million vulnerability loss.Aave previously noted that its liquidation required governance process support, specifically, Aave voted to temporarily manipulate the price of the rsETH oracle to cause losses on the attacker’s fraudulent positions. Aave stated that all adjustments will be fully restored after the liquidation is completed.

According to FinanceFeeds, the victim's lawyer from North Korea attempted to redefine the rsETH attack incident that occurred on Aave as "fraud" rather than "theft" before a hearing at the Manhattan federal court, in order to maintain a freeze order on assets worth $71 million in ETH.The lawyer argued that the attacker borrowed assets using worthless collateral and did not repay, which constitutes a fraudulent loan transaction, aiming to use these frozen assets to pay for terrorism judgment compensation under the Terrorism Risk Insurance Act.Previously, hackers associated with the Lazarus Group minted unsecured rsETH through a cross-chain bridge vulnerability and borrowed approximately $230 million in assets from Aave, of which $71 million was intercepted by Arbitrum developers. The victim's lawyer also questioned Aave's standing, pointing out that its terms of service state it does not have control over user assets. Additionally, DeFi United has raised $327 million, exceeding the amount in dispute.

In response to KelpDAO's accusations against LayerZero regarding the rsETH security incident, LayerZero CEO Bryan Pellegrino tweeted a detailed response, stating that much of the content is completely false.Bryan pointed out that KelpDAO initially used LayerZero's default MultiDVN or DeadDVN configuration and later manually migrated to the 1/1 configuration; under the 1/1 configuration, almost 100% of the transaction volume came from rsETH; LayerZero's documentation repeatedly states that the 1/1 configuration is not recommended for production environments and provides specific transaction records and document screenshots as evidence.