Aave rsETH cross-chain attack has been mitigated, with limited market impact
Wu reported that Aave released a post‑event investigation on April 18 regarding the rsETH incident, stating that the rsETH LayerZero V2 cross‑chain bridge of the liquid staking protocol Kelp accepted forged messages during the Unichain‑to‑Ethereum transfer, causing the Ethereum‑side adapter to release 116,500 rsETH, while no corresponding burn occurred on the Unichain side.
Aave stated that the attack originated from third‑party bridge infrastructure, but the attacker deposited the stolen rsETH into eight Aave V3 positions and borrowed 82,650 WETH and 821 wstETH, affecting the Aave market. Aave added that the rsETH on Arbitrum held by the attacker has been burned, and the LayerZero OFT adapter has distributed five batches to replenish a total of 116,131.72 rsETH, fully restoring rsETH asset backing, and the affected WETH and rsETH markets have returned to normal.
https://t.co/JfvCE9fOSJ