On April 18, an attacker exploited KelpDAO’s LayerZero-powered cross-chain bridge to release 116,500 rsETH ($292M), roughly 18% of the supply.
Rather than dumping the tokens in an illiquid market, the attacker deposited 89,567 rsETH into Aave as collateral, borrowing ETH and WETH across Ethereum and Arbitrum.
Aave rsETH and wrsETH markets were promptly frozen. A bank run ensued, as WETH depositors fled to avoid a potential haircut from WETH bad debt. Major stablecoin markets also saw withdrawals, likely due to further contagion risk and from the liquidity risk of trapped WETH collateral borrowing stables as a makeshift exit. Within hours, WETH, USDC, USDT, DAI markets all reached 100% utilization, where they have remained since.
A full incident report can be found here. Aave was left with $124-230M in bad debt, depending on how losses are handled. Aave TVL has dropped from $26B to $14B since the incident, with major markets still paralyzed. There was very little communication in the days following the exploit from Kelp. Aave was better, but not up to their historical standard.
...rsETH hole filling tracker:
Hole: 112204 rsETH = 118.4k ETH
Lido: -2.5k ETH
Etherfi: -5k ETH
Arbitrum freeze: -30.7k ETH
Ethena: Didn’t say how much, assume -1k ETH
Excess rsETH in aave / coumpound: ~