In a landmark display of cross-protocol crisis management, KelpDAO and Aave have successfully finalized the coordinated destruction of fraudulent rsETH tokens, paving the way for Ethereum withdrawals to resume within 24 hours. The operation involved multi-chain liquidation, asset freezing, and even a US court lifting a freeze on $71 million in recovered ETH.
The Attack: Cross-Chain Bridge Exploit
On April 18, an unknown attacker exploited a vulnerability in KelpDAO's Layerzero-based bridge to mint 116,500 rsETH on Arbitrum without any backing. The attacker then deposited 89,500 rsETH as collateral into Aave V3, borrowing wrapped Ether (wETH) to open a series of under-collateralized positions totaling over $190 million. This posed a potential $230 million bad-debt risk to the protocol.
Swift Community Response
The Aave community froze rsETH markets on both Ethereum and Arbitrum within hours, preventing further exploitation. On May 6, eight of the attacker's positions were liquidated across both chains. The liquidated rsETH was then burned, eliminating the counterfeit tokens from the supply. KelpDAO simultaneously began replenishing its rsETH bridge liquidity pool to restore a 1:1 backing with ETH.
Stani Kulechov, co-founder of Aave, confirmed: “It has been an intensely stressful few weeks, including weekends. With the burn complete and the bridge refilled, ETH withdrawals will resume in 24 hours.”
Legal Hurdle: Lazarus Group Allegations
The recovery hit a snag when a US law firm filed a restraining order on roughly $71 million of recovered ETH, alleging ties to North Korea's Lazarus Group. A federal judge lifted the freeze last week, allowing the funds to flow back to Aave for the final phase. Kulechov praised the judicial speed, calling it “critical for executing the recovery plan.”
Market and Industry Impact
The event underscores the growing ability of DeFi protocols to coordinate across governance, technology, and legal channels during emergencies. Although net losses are still being tallied, the structural damage from the unbacked rsETH mint has been neutralized. Loan-to-value (LTV) ratios for ETH on Aave are returning to normal, and liquidity is expected to stabilize as withdrawals resume. This case sets a precedent for handling similar multi-chain exploits in the future.