🚨 Aave has released its investigation into the Kelp rsETH bridge exploit.

The most important detail:

Aave itself wasn’t hacked.

The failure came from cross-chain infrastructure.

The attacker exploited a LayerZero verification setup, forged a message, and unlocked 116,500 unbacked rsETH before using it as collateral to borrow large amounts of WETH across DeFi.

What makes this incident important is the lesson it exposes:

In DeFi, protocols are only as strong as the infrastructure connected to them.

A lending market can have solid smart contracts, audits, and risk controls.

But a weak bridge can still create systemic risk.

The market spent years focusing on smart contract security.

Now the attention is shifting toward cross-chain security, validator design, and infrastructure trust assumptions.

The next generation of DeFi risk may not come from code bugs.

It may come from the layers connecting everything together.

$ETH ‌