#KelpDAO跨链桥遭攻击

Almost caused AAVE to go bankrupt! A full analysis of the rsETH attack event

Over the weekend, a news story quietly spread in the crypto world: a protocol called Kelp DAO was hacked, losing $290 million. AAVE was affected, and Justin Sun immediately withdrew over $100 million worth of assets from AAVE, triggering a chain reaction. As of this morning, funds outflow from Aave due to the rsETH incident has reached $10.1 billion. As a result, AAVE's price plummeted by nearly $30. This was the largest DeFi attack in 2026, bigger than the Drift incident. How far does its impact extend in the crypto space? Could it become the “LUNA event” that crushes the market in this bear cycle? Let’s discuss.

Kelp DAO protocol issued a token called rsETH, which is designed to provide liquidity for non-liquid assets deposited into re-collateralization platforms (like EigenLayer), and to offer the convenience of a single liquid reset token for accepted LSTs. You can think of it as an “LRT re-staking certificate.”

This token relies on LayerZero cross-chain bridges to jump between different chains.

Yesterday, hackers discovered a vulnerability in LayerZero — simply put:

They forged a “message from Chain A” telling Kelp’s bridge: “Hey, someone deposited ETH on a certain chain, quickly mint 116.5k rsETH for them.”

Kelp’s contract believed it.

As a result, 116,500 rsETH were minted out of thin air, accounting for 18% of the circulating supply, worth $292 million.

After obtaining these rsETH, the hacker did two things:

1. Deposited them as collateral in Aave, Compound, Euler to borrow ETH

2. Sold some directly

Finally, they cashed out 74,000 ETH, about $116.5k.

Because of this rsETH collateral, Aave incurred a bad debt of $236 million.

What does this mean?

The hacker used fake tokens as collateral to borrow real ETH. Now that the fake tokens are worthless, Aave’s collateral is just air. This $236 million loss is borne by Aave itself.

The AAVE token dropped by 10% immediately.

Later, Kelp paused the contract for 46 minutes, but couldn’t save Aave’s $236 million bad debt.

How should we price the systemic risk in DeFi Lego systems?

No one dares to answer this question seriously.

We shout “composability” every day, boast about “money Lego” — but no one tells you:

When you put A protocol’s rsETH into B protocol as collateral, borrow C protocol’s ETH, and finally do LP on D protocol —

You have no idea that a vulnerability in A protocol could cause B, C, and D to blow up together.

📉 So, will this event crush the crypto space and become another “LUNA event”?

First, in terms of direct impact, Bitcoin, as an independent asset with relatively low correlation to DeFi, is not significantly affected. Recent data shows that U.S. spot Bitcoin ETF weekly net inflows still reach nearly $1 billion, indicating that mainstream funds’ confidence in Bitcoin’s fundamentals remains unaffected by this incident.

Second, in terms of indirect impact, the LUNA event didn’t cause a major drop in Bitcoin at the time, but it became the prelude to the last wave of decline in the bear market. The sharp fall of LUNA to zero ultimately spread despair across the crypto community. Today, several years later, AAVE’s price has already fallen by 30%, and there’s still no conclusion on how to handle the $236 million bad debt. This is also why funds continue to flow out of the AAVE protocol.

👀 Next, the key point: how to handle the $236 million bad debt in AAVE. If the situation continues to ferment, AAVE’s price could further decline. But given the low replicability of this event, it probably won’t trigger a death spiral similar to LUNA.

Finally, the question: who should bear the loss of this $236 million bad debt?

A. Aave itself bears the loss (they collected interest from you)

B. Kelp DAO compensates (you sent the tokens)

C. LayerZero compensates (there’s a vulnerability in your code)

D. Users accept it (it’s not the first time anyway)

Leave your answer in the comments!