Aave: 116,500 rsETH minted in April 18 exploit; full backing and market support restored

Aave has published its post-incident review of the April 18 rsETH event, attributing the issue to Kelp's rsETH LayerZero V2 cross-chain bridge. The bridge accepted forged messages during a transfer from Unichain to Ethereum, allowing 116,500 rsETH to be released on Ethereum without a corresponding burn on Unichain. Aave said the exploit stemmed from third-party bridge infrastructure. The attacker deposited the mis-minted rsETH into eight Aave V3 positions and borrowed 82,650 WETH and 821 wstETH, affecting the Aave market. According to Aave, the attacker's rsETH on Arbitrum has been destroyed. The LayerZero OFT adapter has been replenished in five tranches totaling 1,161,317.2 rsETH, restoring full rsETH asset backing. Aave added that the impacted WETH and rsETH markets have returned to normal.