Aave Releases April 18th rsETH Incident Retrospective

May 31 — Aave published a postmortem report for the April 18 rsETH incident, detailing that Kelp’s rsETH LayerZero V2 cross-chain bridge (used for Unichain to Ethereum transfers) received a forged message during a cross-chain transaction. This breach resulted in 116,500 rsETH being minted on Ethereum without a corresponding burn of tokens on Unichain, creating a balance discrepancy. Aave confirmed the attack targeted third-party cross-chain bridge infrastructure. The attacker deposited the stolen rsETH into eight Aave V3 positions, from which they borrowed 82,650 WETH and 821 wstETH, impacting Aave’s markets. Per the report, the attacker’s rsETH holdings on Arbitrum have been burned. To fix the shortfall, LayerZero’s OFT adapter minted 116,131.72 rsETH across five batches, fully restoring rsETH’s asset backing. Both the affected WETH and rsETH markets on Aave have returned to normal functionality.