rseth

Tin tức từ ChainCatcher, Aave đã trải qua khoảng 8.45 tỷ USD rút vốn sau khi cầu nối rsETH của KelpDAO bị tấn công vào tháng 4 năm 2026, nhưng các chức năng cốt lõi của giao thức không gặp sự cố, thành công hoàn thành một trong những bài kiểm tra áp lực thanh khoản lớn nhất trong DeFi cho đến nay. Cuộc khủng hoảng này bắt nguồn từ việc cầu nối đa chuỗi LayerZero của KelpDAO bị tấn công, khoảng 292 triệu USD rsETH đã bị đánh cắp, gây ra lo ngại trên thị trường về giá trị tài sản thế chấp của rsETH và khả năng thanh toán.Do rsETH được sử dụng rộng rãi trong các giao thức như Aave làm tài sản thế chấp, rủi ro nhanh chóng lan rộng, dẫn đến việc người dùng rút vốn tập trung, một số thị trường đã đạt tỷ lệ sử dụng 100% trong một thời điểm, một số người dùng không thể ngay lập tức rút tiền. Đối mặt với tình trạng thanh khoản căng thẳng, đội ngũ quản lý rủi ro của Aave đã khởi động cơ chế đóng băng khẩn cấp và điều chỉnh tham số để hạn chế sự lan rộng của rủi ro.Người sáng lập Aave, Stani Kulechov, coi sự kiện này là bằng chứng cho sự trưởng thành của DeFi, cho rằng giao thức vẫn hoạt động theo thiết kế dưới áp lực cực đoan, thể hiện tính bền bỉ của hệ thống minh bạch và quy tắc điều khiển trên chuỗi. Tuy nhiên, nhiều nhà phân tích độc lập chỉ ra rằng, mặc dù Aave đã tránh được sự sụp đổ hệ thống, nhưng sự kiện này đã phơi bày ra rằng hệ thống cho vay DeFi vẫn tồn tại rủi ro tập trung, rủi ro thanh khoản và rủi ro lây lan do sự liên kết cao giữa các giao thức. Hành vi của những người vay lớn có thể ảnh hưởng đến sự ổn định của toàn bộ hệ thống vượt quá dự đoán của mô hình.Hiện tại, Aave kiểm soát rủi ro thông qua nhiều biện pháp bảo vệ như giới hạn tỷ lệ giá trị khoản vay (LTV), ngưỡng thanh lý, giới hạn cung cấp, giới hạn vay, Chế độ cách ly, Chế độ E và cơ chế quản trị. Những cơ chế này đã phát huy tác dụng trong cuộc khủng hoảng lần này, nhưng các quan sát viên cho rằng, tốc độ phản ứng của quản trị và mô hình rủi ro vẫn cần được tối ưu hóa hơn nữa để đối phó với các cú sốc hệ thống chưa biết trong tương lai.Phân tích cho rằng, sự kiện này cho thấy các giao thức DeFi có thể chịu đựng được sự rút vốn quy mô lớn mà không cần cứu trợ bên ngoài, nhưng một bài kiểm tra áp lực đơn lẻ không thể hoàn toàn chứng minh tính an toàn của hệ thống. Khi tính khả thi giữa các giao thức ngày càng tăng, một vấn đề về tài sản bên ngoài hoặc cầu nối đa chuỗi vẫn có thể nhanh chóng biến thành cuộc khủng hoảng thanh khoản của toàn bộ hệ sinh thái.

Regarding the attack on the Kelp rsETH LayerZero V2 bridge that occurred on April 18, Aave released a post-incident investigation on the X platform, emphasizing that the exposure was primarily due to third-party bridge infrastructure rather than the protocol itself. The attacker executed an RPC poisoning attack targeting a single validator of LayerZero, forging a cross-chain message. This led to the release of 116,500 rsETH on the Ethereum side without actual destruction on Unichain. The attacker subsequently deposited the stolen rsETH into Aave V3 (Ethereum Core and Arbitrum), borrowing approximately 82,650 WETH and 821 wstETH.The Aave Protocol Guardian and Risk Steward immediately implemented protective measures for the rsETH and WETH reserves. Currently, the WETH and rsETH markets in the affected V3 deployments are operating normally. The rsETH held by the attacker on Arbitrum has been destroyed, the LayerZero OFT adapter has been fully recharged in five batches, rsETH support has been fully restored, and Kelp has reopened the withdrawal, bridging, and claims functions for rsETH. The WETH LTV in the affected markets has been reset to pre-attack values, and Aave V3 is fully operational across all markets except for rsETH.The Arbitrum DAO has voted to authorize the transfer of frozen ETH to Aave LLC, and it is currently awaiting on-chain execution. The court is still reviewing the substantive content of the injunction, and Aave LLC will continue to comply with the injunction during the court's deliberation. Ongoing projects include: the Aave risk framework from Llama Risk, the bridging assessment framework, the release of evaluation reports for currently live assets, on-chain execution of Arbitrum DAO votes, and the court's review of the injunction.

Kelp DAO announced on Monday that after losing $293 million due to an attack by North Korea's Lazarus Group on April 18, rsETH has been fully restored after five weeks of repairs. Kelp DAO stated that the final batch of 20,373.7 rsETH has been sent to the LayerZero smart contract responsible for cross-chain transfers, officially concluding the operational phase of the rsETH recovery plan.Multiple crypto protocols contributed funds through the DeFi United initiative to assist in restoring the support for rsETH. The first batch of 25,000 rsETH was transferred on May 13, and withdrawals were reopened the next day. Currently, minting, redemption, and reward operations are all functioning normally. This attack caused a chain reaction in the DeFi lending market, with the attacker borrowing WETH using a large amount of stolen rsETH as collateral on Aave, resulting in Aave incurring $190 million in bad debt. The TVL dropped from $26.4 billion to below $14 billion and has since remained in the range of $13.9 billion to $15.1 billion without showing signs of recovery. In April, there were 25 crypto hacking incidents, resulting in total losses of $630 million.

According to official news, KelpDAO stated that the last batch of 20,373.72 rsETH has been transferred to the rsETH OFT adapter earlier, thus completing the operational part of the rsETH recovery plan. KelpDAO also attached the relevant transaction information.

Kelp stated on platform X that it has collaborated with multiple DeFi protocols to complete the liquidation of the attacker’s positions, and the recovery process of rsETH has made significant progress. Among them, Compound has participated in coordination multiple times over the past four weeks and provided about 3,000 ETH in support, while jointly completing the liquidation with Aave, recovering a total of approximately 17,426.2 rsETH. Euler Finance has liquidated the attacker’s positions within its protocol and plans to return the excess ETH to the DeFi ecosystem fund.

On-chain analyst Tom Wan posted on the X platform, stating that the current ETH utilization rate has fallen below 90%, and the lending APY has dropped to 1.9%. Since the rsETH LayerZero cross-chain bridge was attacked, the deposit scales of wstETH and weETH have decreased by approximately $1.2 billion and $1.76 billion, respectively.As the wstETH/weETH circular leverage strategy returns to profitability, the market's focus shifts to whether the demand for ETH circular leverage will return or if funds will continue to observe or flow to protocols like Spark and Morpho.

Kelp announced on platform X that to ensure the security standards of rsETH and optimize network integration, cross-chain support for rsETH on multiple networks will be stopped after June 15. The affected networks include Optimism, Manta, Mode, Blast, Scroll, X Layer, zkSync, Zircuit, Swellchain, Hemi, Berachain, Sonic, HyperEVM, Unichain, TAC, Avalanche, Plasma Stable, MegaETH, Monad, and Movement.Kelp reminds users holding rsETH on the above chains that they need to bridge back to the Ethereum mainnet before June 15. After June 15, asset recovery can still be requested, but each address will need to pay a fee of 100 USDC. The specific process will be announced as the deadline approaches.

Aave founder Stani Kulechov posted on the X platform that the next step of the rsETH technical recovery plan has been completed, and the loan-to-value (LTV) ratios of WETH loans across all affected networks have been restored to pre-event levels. Users can now again borrow on Aave using WETH as collateral, including through collateral and debt swaps.According to the Aave announcement, this recovery involves network deployments such as Aave V3 Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle, and Linea.

Kelp announced on platform X that the rsETH protocol has fully resumed normal operation, and the related functions have been re-launched on the mainnet and all Layer 2 networks, with the overall system status restored to normal levels. The rsETH exchange rate has been updated, accounting for all staking reward earnings accumulated during the suspension period. Meanwhile, EIGEN rewards are now open for distribution to rsETH holders, covering the entire suspension period.In addition, the deposit and withdrawal functions have been restored on the mainnet and Layer 2 networks, and the rsETH asset support status has been fully restored to 100% backing. The official emphasized that the current rsETH has achieved complete and sufficient support on the mainnet and L2 networks, and all operational processes have returned to normal.

The Compound Foundation stated that, after closely collaborating with the Aave and KelpDAO teams, the relevant positions of the rsETH exploiters in WETH and wstETH Comet have all been liquidated over the weekend, and all rsETH held by the attackers has been transferred to DeFi United. Compound noted that the swift action effectively mitigated market risks and protected the safety of the protocol's suppliers and reserve funds.Compound also updated that the transfer restrictions for Ethereum WETH and wstETH Comet have now been lifted, and all Comet markets have resumed normal operations. The protocol stated that the top priority remains ensuring the overall safety of the platform and thanked the Aave and KelpDAO teams for their collaboration during the incident handling process.

Aave stated that the first batch of rsETH has been transferred to LayerZero's OFT adapter, and cross-chain operations for rsETH between the mainnet and various L2s have been reopened.This progress means that the previously affected rsETH cross-chain channels have been restored for use, covering the Ethereum mainnet and L2 networks.

Aave stated that the first steps of the rsETH technical recovery plan have been completed, which includes the destruction of the rsETH held by the attacker on Arbitrum. In the coming days, stakeholders will gradually replenish funds to the LayerZero OFT adapter and restart rsETH-related operations in phases.Kelp previously stated that it has completed a series of rsETH endorsement recovery steps with Aave, planning to gradually inject 117,132 rsETH from the Aave Recovery Guardian and Kelp Recovery Safe into the LayerZero OFT adapter on the Ethereum mainnet.

Aave posted on platform X that the second phase of the rsETH event recovery technical plan has made progress. The 8 positions of the hacker on Aave V3 have been liquidated, and the recovered rsETH collateral has been handed over to the recovery custodian. The Arbitrum DAO has passed a proposal to return the previously recovered $71 million ETH.In response to the plaintiff's application for fund seizure, the judge has approved Aave LLC's proposal, allowing the transfer of the $71 million ETH to Aave LLC through on-chain voting by the Arbitrum DAO. Subsequent plans include destroying rsETH on Arbitrum and restoring the rsETH reserve. Once the reserve is restored, withdrawals will be reopened, and the WETH LTV on the Aave V3 Ethereum mainnet will be reinstated.

The Mantle community has authorized the Mantle Treasury to provide a loan of up to 30,000 ETH to the Aave DAO through proposal MIP - 34, to address the bad debt impact caused by the rsETH cross-chain bridge security incident on Aave V3.According to the proposal, the loan term is up to 36 months, with an interest rate of LIDO + 1% annualized, and the borrower can repay early without penalty. In terms of risk control, Mantle will have priority security rights over the relevant collateral assets, and Aave will also provide additional collateral in the form of Aave tokens and protocol revenue worth no less than $11 million, and will delegate 130,000 Aave tokens to Mantle for governance participation.

Mantle token holders have approved a credit line of up to 30,000 ETH (approximately $68 million) to Aave DAO through the MIP-34 proposal. This move aims to help address the potential bad debt issues arising from the rsETH attack incident in April, which is estimated to have caused bad debts between $123.7 million and $230.1 million.The proposal was passed in a seven-day Snapshot vote, authorizing the Mantle Foundation to negotiate and execute the final loan agreement with Aave DAO. The final implementation of this credit line still depends on Aave executing its recovery plan and finalizing specific terms.A Galaxy Research report noted that the rsETH attack incident had put Aave's WETH market under continuous strain, with the utilization rate remaining above 99% for 12.7 consecutive days. As of May 8, the utilization rate of Aave Ethereum V3's WETH market has dropped to about 91.6%, indicating some relief in market pressure.

According to The Block, the on-chain lending platform Aave has completed the liquidation of the remaining rsETH positions of the Kelp DAO attacker as part of the previously announced recovery plan.The collateral obtained from the liquidation will be transferred to a multi-signature address "Recovery Guardian" managed by the DeFi United initiative, which is working to restore the asset backing of rsETH and compensate affected users. This process marks one of the final stages of the community's efforts to make up for the $292 million vulnerability loss.Aave previously noted that its liquidation required governance process support, specifically, Aave voted to temporarily manipulate the price of the rsETH oracle to cause losses on the attacker’s fraudulent positions. Aave stated that all adjustments will be fully restored after the liquidation is completed.

According to FinanceFeeds, the victim's lawyer from North Korea attempted to redefine the rsETH attack incident that occurred on Aave as "fraud" rather than "theft" before a hearing at the Manhattan federal court, in order to maintain a freeze order on assets worth $71 million in ETH.The lawyer argued that the attacker borrowed assets using worthless collateral and did not repay, which constitutes a fraudulent loan transaction, aiming to use these frozen assets to pay for terrorism judgment compensation under the Terrorism Risk Insurance Act.Previously, hackers associated with the Lazarus Group minted unsecured rsETH through a cross-chain bridge vulnerability and borrowed approximately $230 million in assets from Aave, of which $71 million was intercepted by Arbitrum developers. The victim's lawyer also questioned Aave's standing, pointing out that its terms of service state it does not have control over user assets. Additionally, DeFi United has raised $327 million, exceeding the amount in dispute.

In response to KelpDAO's accusations against LayerZero regarding the rsETH security incident, LayerZero CEO Bryan Pellegrino tweeted a detailed response, stating that much of the content is completely false.Bryan pointed out that KelpDAO initially used LayerZero's default MultiDVN or DeadDVN configuration and later manually migrated to the 1/1 configuration; under the 1/1 configuration, almost 100% of the transaction volume came from rsETH; LayerZero's documentation repeatedly states that the 1/1 configuration is not recommended for production environments and provides specific transaction records and document screenshots as evidence.