Overview
- Curve founder Michael Egorov called for a common DeFi security rulebook after the KelpDAO rsETH breach.
- An attacker forged a cross‑chain message to steal about 116,500 rsETH, worth roughly $293 million; rsETH is a token that represents restaked ether used across chains.
- LayerZero said the exploit was possible because KelpDAO relied on a single verifier with no backup in its messaging setup.
- The thief deposited the stolen token on Aave as collateral to borrow at scale, which drove more than $10 billion in withdrawals and led Aave to freeze rsETH markets on V3 and V4.
- Protocols moved to contain risk as nine projects restricted rsETH activity, and Arbitrum’s security council seized about 30,766 ETH linked to the attacker’s address; Egorov urged foundations to convene best practices on verifiers, rate limits, multisigs, and kill switches.