Overview of responses to the RsETH hacking incident: Multiple parties have suspended the LayerZero OFT cross-chain bridge, rsETH remains frozen on Aave

Mars Finance message: On April 20, Saturday, the rsETH LayerZero cross-chain bridge under Kelp DAO’s liquid re-pledging token was hacked, becoming the largest DeFi hacking incident to date in 2026. The attacker forged LayerZero cross-chain messages to directly extract 116,500 rsETH from the bridge contract and deposit them into lending platforms such as Aave to borrow WETH, creating a major risk of unsecured bad debt. An overview of the actions taken by various DeFi protocols in response to the rsETH hacking incident:

• Aave releases the latest update on the rsETH incident: rsETH on the Ethereum mainnet is fully supported by complete collateralization. rsETH remains frozen on Aave V3 and V4. WETH reserves are also frozen in affected markets, including Ethereum, Arbitrum, Base, Mantle, and Linea. Aave is actively verifying the information and assessing potential solutions.

• Ethena officially decides to extend the suspension of the LayerZero OFT cross-chain bridge. At the same time, Ethena released its latest reserve proof, confirming that the USDe collateral support rate remains at 100% or above.

• LayerZero said that it has a comprehensive understanding of the rsETH vulnerability incident, and has been actively working with the KelpDAO team on fixes since the incident occurred, while continuously monitoring the situation. Other applications remain secure. After obtaining all information, it will publish a complete post-incident analysis report together with KelpDAO.

• Fluid officially announced the launch of the aWETH redemption protocol. The aWETH redemption protocol will allow ETH lenders to: redeem for wstETH or weETH, immediately restore liquidity, and reduce liquidation risk. If users only lend ETH, they can redeem in full. If users have ETH collateral and other debts, the collateral will be seamlessly converted into wstETH or weETH, while the debt remains unchanged. The protocol’s initial capacity limit is 1 billion worth of ETH.

• Morpho officially paused MORPHO’s OFT cross-chain bridge on Arbitrum until the root cause of the rsETH incident is identified. Morpho stated that the smart contracts are secure and still functioning normally as expected; risk exposure is limited—only about 1 million worth of ETH was borrowed using rsETH as collateral across two isolated markets out of thousands of markets. Because Morpho uses a fully isolated market design, all other vaults are unaffected.

• Curve Finance officially announced the suspension of Curve’s LayerZero infrastructure. This action will affect: CRV bridging from the following chains: BNB, Sonic, Avalanche, Fantom, Etherlink, Kava (other chains still use native bridging); and the fast bridging of crvUSD (slow bridging on L2 can still be used normally).

• Reserve issued an official announcement stating that it has determined that Reserve DTF holders are unlikely to be affected almost at all. RSR stakers in Reserve Protocol USD3 and eUSD may provide protection as “first-loss capital,” but the impact is extremely small, and RSR’s over-collateralization is sufficient to cover it. ETH+ and bsdETH contain no rsETH collateral, posing zero risk. Out of caution, Reserve has temporarily paused the minting and rebalancing of eUSD and USD3, as well as RSR unstaking. Redemption functionality remains open as normal.

• Maple Finance issued an official announcement: all USDT provided via syrupUSDT on Aave Mantle have been withdrawn. syrupUSDC and syrupUSDT are not affected by the rsETH vulnerability.

• Polygon stated that it has been actively monitoring the rsETH vulnerability: Polygon Chain, Agglayer, and the entire ecosystem—including Katana and Vaultbridge—have not been affected by this incident.

• EtherFi issued an official announcement: the protocol’s liquidity vaults are unaffected by the Kelp rsETH incident, and vault users will not suffer any fund losses.

• Hyperliquid ecosystem DeFi project Hyperwave announced that, as a precaution, it has temporarily suspended the LayerZero bridges for all Hyperwave assets.