Overview
- KelpDAO’s bridge, which was hit Saturday, released 116,500 rsETH worth about $292–$294 million after its LayerZero verifier accepted a forged instruction that looked like a valid transfer.
- The attacker turned much of the haul into roughly 106,000 ETH, moved funds through a Tornado Cash–funded address, and posted rsETH as collateral on Aave to borrow real assets.
- Aave’s analysis now pegs potential bad debt at about $123 million if losses are spread across all rsETH or up to $230 million if isolated to Layer 2 tokens, after it froze rsETH markets and set borrowing power to zero.
- DeFi deposits fell by about $10–$13.2 billion over 48 hours, and Aave’s USDT and USDC pools reached 100% utilization, which left more than $5.1 billion in stablecoins temporarily unavailable to withdraw.
- Multiple projects paused rsETH markets or LayerZero links as the investigation continues, with LayerZero suggesting DPRK-linked actors and KelpDAO indicating it will dispute that attribution.