the rsETH exploit<\/a>. The protocol lost $230 million. But the breach wasn’t in their own code.<\/p>\nThe exploit traced back to KelpDAO’s LayerZero-powered bridge. Attackers found a single weak verifier. They used it to forge a cross-chain message. That let them mint 116,500 unbacked rsETH on Ethereum. These tokens had nothing behind them. But they looked real enough to deposit into Aave.<\/p>\n
Aave’s postmortem revealed how attackers exploited the system. They used a single compromised verifier on LayerZero. This verifier was supposed to confirm legitimate cross-chain transfers. Instead, it approved fake messages.<\/p>\n
KelpDAO’s rsETH token was supposed to represent staked ETH. Users could stake ETH on one chain and get rsETH on another. The bridge was supposed to maintain a 1:1 peg. But the attacker broke this peg by creating rsETH out of thin air. These tokens entered Aave’s lending pools. They looked legitimate because they came from a recognized protocol.<\/p>\n
The protocol’s response shows how serious this is. They’re not just patching a bug. They’re rewriting the rulebook for listing assets. The old standards assumed on-chain security was the main concern. The new standards must account for cross-chain risks.<\/p>\n
This incident highlights a broader trend in DeFi security. As protocols become more interconnected through bridges, the attack surface expands dramatically. What started as isolated smart contract risks has evolved into complex cross-chain vulnerabilities that are harder to detect and prevent. The Aave exploit demonstrates that even well-audited protocols can be compromised through their connections to less secure infrastructure.<\/p>\n
Prior analogs<\/h3>\n\n- The Wormhole bridge hack in February 2022 saw $324 million stolen. It showed how bridges could become crypto’s weakest links. The exploit involved forged signatures that allowed attackers to mint unlimited tokens, similar to the rsETH case where verification was compromised.<\/li>\n
- The Nomad bridge exploit in August 2022 drained $190 million. Attackers exploited a simple smart contract update bug. This incident revealed how even minor code changes in bridge infrastructure can create catastrophic vulnerabilities.<\/li>\n
- The Multichain bridge collapse in July 2023 caused over $125 million in losses. It revealed the dangers of centralized bridge operators and single points of failure, echoing the single verifier compromise in the rsETH exploit.<\/li>\n<\/ul>\n\t\t