Aave: 116,500 rsETH Released in April 18 Incident; Asset Backing Fully Restored

Odaily reports that Aave has published a post-mortem of the rsETH incident on April 18, stating that the rsETH LayerZero V2 bridge of liquid staking protocol Kelp accepted a forged message during a cross-chain transfer from Unichain to Ethereum. This caused the Ethereum-side adapter to release 116,500 rsETH, while no corresponding burn occurred on the Unichain side. Aave stated that the attack occurred on a third-party bridge infrastructure. However, the attacker deposited the stolen rsETH into 8 Aave V3 positions and borrowed 82,650 WETH and 821 wstETH, impacting the Aave market.

Aave stated that the attacker's rsETH on Arbitrum has now been burned. The LayerZero OFT adapter has replenished 116,131.72 rsETH in 5 batches. The asset backing for rsETH has been fully restored, and the affected WETH and rsETH markets have returned to normal.