In 46 minutes on Saturday evening, DeFi lost more money than it had in any single event this year, and left Aave to face its biggest challenge yet. The mechanics took roughly one transaction.
At 17:35 UTC on April 18, an attacker sent a crafted message to Kelp DAO's LayerZero-powered cross-chain bridge. The bridge accepted it as legitimate and released 116,500 rsETH, worth about $293 million and roughly 18% of the token's entire circulating supply, to a wallet that had been funded through Tornado Cash ten hours earlier. No ETH ever changed hands on the other side, which means rsETH was effectively spun out of thin air.
The attacker did not try to sell it. They deposited it into Aave V3 as collateral and borrowed real wrapped ether against it, then repeated the trick on Aave V4. By the time Kelp's emergency multisig froze the protocol's core contracts 46 minutes later, the WETH was gone.
To continue reading this as well as other DeFi and Web3 news, visit us at thedefiant.io
