Andre Cronje: Around $200 million worth of rsETH was stolen either due to a private key leak or a misconfiguration. The stolen funds have been withdrawn from Aave to protect liquidity

April 19th: Andre Cronje, co-founder of Sonic Labs and founder of Flying Tulip, said the team is still investigating the L0/rsETH incident. Initial reports suggest a private key leak or configuration error may have led to ~$200 million in rsETH being stolen. The stolen rsETH was then deposited into Aave to borrow ETH (given rsETH’s low liquidity). The position is technically collateralized; even without collateral, Aave’s token and safety module act as the first line of defense against defaults. Aave has no mechanism to reimburse users for losses, so extreme cases could trigger a "bank run." However, Aave currently holds ~$7 billion worth of ETH, compared to ~$100 million in withdrawal volume and $17 million in PUT exposure—limiting the overall impact. While the above is just our initial assessment, protecting user PUT liquidity remains our top priority. As such, we’ve withdrawn all ETH from Aave to our self-contained contract, as Aave’s available liquidity has fallen below our minimum threshold.