rseth

Сообщение ChainCatcher, Aave после атаки на кросс-цепочный мост rsETH KelpDAO в апреле 2026 года испытал вывод средств на сумму около 8,45 миллиарда долларов, но основные функции протокола не вышли из строя, успешно завершив одно из крупнейших в истории DeFi тестов на ликвидность. Эта кризисная ситуация возникла из-за атаки на кросс-цепочный мост LayerZero KelpDAO, в результате которой было украдено около 292 миллионов долларов rsETH, что вызвало опасения на рынке относительно стоимости и платежеспособности залога rsETH.Поскольку rsETH широко используется в таких протоколах, как Aave, в качестве залогового актива, риск быстро распространился, что привело к массовому выводу средств пользователями, в некоторых рынках коэффициент использования достигал 100%, и некоторые пользователи не могли немедленно вывести свои средства. В условиях нехватки ликвидности команда управления рисками Aave активировала механизм экстренной заморозки и корректировки параметров, чтобы ограничить распространение рисков.Основатель Aave Стани Кулечов рассматривает это событие как доказательство повышения зрелости DeFi, полагая, что протокол продолжает функционировать по проекту даже под экстремальным давлением, демонстрируя устойчивость системы, основанной на прозрачности и правилах. Однако несколько независимых аналитиков указывают на то, что, хотя Aave и избежал системного краха, событие выявило существующие риски концентрации, ликвидности и риски заражения, связанные с высокой взаимосвязанностью протоколов в системе DeFi. Поведение крупных заемщиков может оказать влияние на стабильность всей системы, превышающее ожидаемое по моделям.В настоящее время Aave контролирует риски с помощью многоуровневых мер защиты, таких как ограничение отношения займа к стоимости (LTV), пороги ликвидации, лимиты поставок, лимиты заимствования, режим изоляции, E-Mode и механизмы управления. Эти механизмы в целом сработали в кризисной ситуации, но наблюдатели считают, что скорость реакции управления и модели рисков все еще нуждаются в дальнейшей оптимизации для противодействия будущим неизвестным системным шокам.Анализ показывает, что это событие демонстрирует, что DeFi-протоколы могут выдерживать массовые выводы средств без внешней помощи, но одноразовое тестирование на давление не может полностью доказать безопасность системы. С увеличением совместимости между протоколами проблема с внешним активом или кросс-цепочным мостом все еще может быстро перерасти в кризис ликвидности для всей экосистемы.

Regarding the attack on the Kelp rsETH LayerZero V2 bridge that occurred on April 18, Aave released a post-incident investigation on the X platform, emphasizing that the exposure was primarily due to third-party bridge infrastructure rather than the protocol itself. The attacker executed an RPC poisoning attack targeting a single validator of LayerZero, forging a cross-chain message. This led to the release of 116,500 rsETH on the Ethereum side without actual destruction on Unichain. The attacker subsequently deposited the stolen rsETH into Aave V3 (Ethereum Core and Arbitrum), borrowing approximately 82,650 WETH and 821 wstETH.The Aave Protocol Guardian and Risk Steward immediately implemented protective measures for the rsETH and WETH reserves. Currently, the WETH and rsETH markets in the affected V3 deployments are operating normally. The rsETH held by the attacker on Arbitrum has been destroyed, the LayerZero OFT adapter has been fully recharged in five batches, rsETH support has been fully restored, and Kelp has reopened the withdrawal, bridging, and claims functions for rsETH. The WETH LTV in the affected markets has been reset to pre-attack values, and Aave V3 is fully operational across all markets except for rsETH.The Arbitrum DAO has voted to authorize the transfer of frozen ETH to Aave LLC, and it is currently awaiting on-chain execution. The court is still reviewing the substantive content of the injunction, and Aave LLC will continue to comply with the injunction during the court's deliberation. Ongoing projects include: the Aave risk framework from Llama Risk, the bridging assessment framework, the release of evaluation reports for currently live assets, on-chain execution of Arbitrum DAO votes, and the court's review of the injunction.

Kelp DAO announced on Monday that after losing $293 million due to an attack by North Korea's Lazarus Group on April 18, rsETH has been fully restored after five weeks of repairs. Kelp DAO stated that the final batch of 20,373.7 rsETH has been sent to the LayerZero smart contract responsible for cross-chain transfers, officially concluding the operational phase of the rsETH recovery plan.Multiple crypto protocols contributed funds through the DeFi United initiative to assist in restoring the support for rsETH. The first batch of 25,000 rsETH was transferred on May 13, and withdrawals were reopened the next day. Currently, minting, redemption, and reward operations are all functioning normally. This attack caused a chain reaction in the DeFi lending market, with the attacker borrowing WETH using a large amount of stolen rsETH as collateral on Aave, resulting in Aave incurring $190 million in bad debt. The TVL dropped from $26.4 billion to below $14 billion and has since remained in the range of $13.9 billion to $15.1 billion without showing signs of recovery. In April, there were 25 crypto hacking incidents, resulting in total losses of $630 million.

According to official news, KelpDAO stated that the last batch of 20,373.72 rsETH has been transferred to the rsETH OFT adapter earlier, thus completing the operational part of the rsETH recovery plan. KelpDAO also attached the relevant transaction information.

Kelp stated on platform X that it has collaborated with multiple DeFi protocols to complete the liquidation of the attacker’s positions, and the recovery process of rsETH has made significant progress. Among them, Compound has participated in coordination multiple times over the past four weeks and provided about 3,000 ETH in support, while jointly completing the liquidation with Aave, recovering a total of approximately 17,426.2 rsETH. Euler Finance has liquidated the attacker’s positions within its protocol and plans to return the excess ETH to the DeFi ecosystem fund.

On-chain analyst Tom Wan posted on the X platform, stating that the current ETH utilization rate has fallen below 90%, and the lending APY has dropped to 1.9%. Since the rsETH LayerZero cross-chain bridge was attacked, the deposit scales of wstETH and weETH have decreased by approximately $1.2 billion and $1.76 billion, respectively.As the wstETH/weETH circular leverage strategy returns to profitability, the market's focus shifts to whether the demand for ETH circular leverage will return or if funds will continue to observe or flow to protocols like Spark and Morpho.

Kelp announced on platform X that to ensure the security standards of rsETH and optimize network integration, cross-chain support for rsETH on multiple networks will be stopped after June 15. The affected networks include Optimism, Manta, Mode, Blast, Scroll, X Layer, zkSync, Zircuit, Swellchain, Hemi, Berachain, Sonic, HyperEVM, Unichain, TAC, Avalanche, Plasma Stable, MegaETH, Monad, and Movement.Kelp reminds users holding rsETH on the above chains that they need to bridge back to the Ethereum mainnet before June 15. After June 15, asset recovery can still be requested, but each address will need to pay a fee of 100 USDC. The specific process will be announced as the deadline approaches.

Aave founder Stani Kulechov posted on the X platform that the next step of the rsETH technical recovery plan has been completed, and the loan-to-value (LTV) ratios of WETH loans across all affected networks have been restored to pre-event levels. Users can now again borrow on Aave using WETH as collateral, including through collateral and debt swaps.According to the Aave announcement, this recovery involves network deployments such as Aave V3 Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle, and Linea.

Kelp announced on platform X that the rsETH protocol has fully resumed normal operation, and the related functions have been re-launched on the mainnet and all Layer 2 networks, with the overall system status restored to normal levels. The rsETH exchange rate has been updated, accounting for all staking reward earnings accumulated during the suspension period. Meanwhile, EIGEN rewards are now open for distribution to rsETH holders, covering the entire suspension period.In addition, the deposit and withdrawal functions have been restored on the mainnet and Layer 2 networks, and the rsETH asset support status has been fully restored to 100% backing. The official emphasized that the current rsETH has achieved complete and sufficient support on the mainnet and L2 networks, and all operational processes have returned to normal.

The Compound Foundation stated that, after closely collaborating with the Aave and KelpDAO teams, the relevant positions of the rsETH exploiters in WETH and wstETH Comet have all been liquidated over the weekend, and all rsETH held by the attackers has been transferred to DeFi United. Compound noted that the swift action effectively mitigated market risks and protected the safety of the protocol's suppliers and reserve funds.Compound also updated that the transfer restrictions for Ethereum WETH and wstETH Comet have now been lifted, and all Comet markets have resumed normal operations. The protocol stated that the top priority remains ensuring the overall safety of the platform and thanked the Aave and KelpDAO teams for their collaboration during the incident handling process.

Aave stated that the first batch of rsETH has been transferred to LayerZero's OFT adapter, and cross-chain operations for rsETH between the mainnet and various L2s have been reopened.This progress means that the previously affected rsETH cross-chain channels have been restored for use, covering the Ethereum mainnet and L2 networks.

Aave stated that the first steps of the rsETH technical recovery plan have been completed, which includes the destruction of the rsETH held by the attacker on Arbitrum. In the coming days, stakeholders will gradually replenish funds to the LayerZero OFT adapter and restart rsETH-related operations in phases.Kelp previously stated that it has completed a series of rsETH endorsement recovery steps with Aave, planning to gradually inject 117,132 rsETH from the Aave Recovery Guardian and Kelp Recovery Safe into the LayerZero OFT adapter on the Ethereum mainnet.

Aave posted on platform X that the second phase of the rsETH event recovery technical plan has made progress. The 8 positions of the hacker on Aave V3 have been liquidated, and the recovered rsETH collateral has been handed over to the recovery custodian. The Arbitrum DAO has passed a proposal to return the previously recovered $71 million ETH.In response to the plaintiff's application for fund seizure, the judge has approved Aave LLC's proposal, allowing the transfer of the $71 million ETH to Aave LLC through on-chain voting by the Arbitrum DAO. Subsequent plans include destroying rsETH on Arbitrum and restoring the rsETH reserve. Once the reserve is restored, withdrawals will be reopened, and the WETH LTV on the Aave V3 Ethereum mainnet will be reinstated.

The Mantle community has authorized the Mantle Treasury to provide a loan of up to 30,000 ETH to the Aave DAO through proposal MIP - 34, to address the bad debt impact caused by the rsETH cross-chain bridge security incident on Aave V3.According to the proposal, the loan term is up to 36 months, with an interest rate of LIDO + 1% annualized, and the borrower can repay early without penalty. In terms of risk control, Mantle will have priority security rights over the relevant collateral assets, and Aave will also provide additional collateral in the form of Aave tokens and protocol revenue worth no less than $11 million, and will delegate 130,000 Aave tokens to Mantle for governance participation.

Mantle token holders have approved a credit line of up to 30,000 ETH (approximately $68 million) to Aave DAO through the MIP-34 proposal. This move aims to help address the potential bad debt issues arising from the rsETH attack incident in April, which is estimated to have caused bad debts between $123.7 million and $230.1 million.The proposal was passed in a seven-day Snapshot vote, authorizing the Mantle Foundation to negotiate and execute the final loan agreement with Aave DAO. The final implementation of this credit line still depends on Aave executing its recovery plan and finalizing specific terms.A Galaxy Research report noted that the rsETH attack incident had put Aave's WETH market under continuous strain, with the utilization rate remaining above 99% for 12.7 consecutive days. As of May 8, the utilization rate of Aave Ethereum V3's WETH market has dropped to about 91.6%, indicating some relief in market pressure.

According to The Block, the on-chain lending platform Aave has completed the liquidation of the remaining rsETH positions of the Kelp DAO attacker as part of the previously announced recovery plan.The collateral obtained from the liquidation will be transferred to a multi-signature address "Recovery Guardian" managed by the DeFi United initiative, which is working to restore the asset backing of rsETH and compensate affected users. This process marks one of the final stages of the community's efforts to make up for the $292 million vulnerability loss.Aave previously noted that its liquidation required governance process support, specifically, Aave voted to temporarily manipulate the price of the rsETH oracle to cause losses on the attacker’s fraudulent positions. Aave stated that all adjustments will be fully restored after the liquidation is completed.

According to FinanceFeeds, the victim's lawyer from North Korea attempted to redefine the rsETH attack incident that occurred on Aave as "fraud" rather than "theft" before a hearing at the Manhattan federal court, in order to maintain a freeze order on assets worth $71 million in ETH.The lawyer argued that the attacker borrowed assets using worthless collateral and did not repay, which constitutes a fraudulent loan transaction, aiming to use these frozen assets to pay for terrorism judgment compensation under the Terrorism Risk Insurance Act.Previously, hackers associated with the Lazarus Group minted unsecured rsETH through a cross-chain bridge vulnerability and borrowed approximately $230 million in assets from Aave, of which $71 million was intercepted by Arbitrum developers. The victim's lawyer also questioned Aave's standing, pointing out that its terms of service state it does not have control over user assets. Additionally, DeFi United has raised $327 million, exceeding the amount in dispute.

In response to KelpDAO's accusations against LayerZero regarding the rsETH security incident, LayerZero CEO Bryan Pellegrino tweeted a detailed response, stating that much of the content is completely false.Bryan pointed out that KelpDAO initially used LayerZero's default MultiDVN or DeadDVN configuration and later manually migrated to the 1/1 configuration; under the 1/1 configuration, almost 100% of the transaction volume came from rsETH; LayerZero's documentation repeatedly states that the 1/1 configuration is not recommended for production environments and provides specific transaction records and document screenshots as evidence.