rsETH LayerZero bridge hacked, Aave and other protocols urgently freeze funds

Kelp DAO’s liquidity re-staking token rsETH’s LayerZero cross-chain bridge was attacked by hackers on April 19 (Saturday), 2026—marking the largest DeFi security incident to date this year. Multiple major DeFi protocols have responded with emergency measures one after another, freezing or pausing LayerZero-related functionality.

Attack Mechanism: Forged Cross-Chain Messages Bypass Bridge Contract Verification

The core of this attack lies in a vulnerability in LayerZero message verification. By forging what appear to be legitimate cross-chain messages, the attackers caused the bridge contract to mistakenly believe it had received a valid request, directly releasing 116,500 rsETH to an address controlled by the attacker. This attack pattern did not directly compromise the smart contracts of lending protocols such as Aave. Instead, the attackers only needed to deposit the stolen assets as “legitimate” collateral to borrow a large amount of WETH, creating an exposure to bad debts that the affected protocols may be unable to fully recover.

Emergency Measures by Major Protocols — Overview

Aave: rsETH remains frozen on V3 and V4; rsETH on the Ethereum mainnet has full collateral support; WETH reserves are frozen in the affected markets (Ethereum, Arbitrum, Base, Mantle, Linea) as well; solutions are being actively assessed.

Ethena: Extends the pause period of the LayerZero OFT bridge; confirms that USDe collateral support remains above 100%.

Fluid: Launches an aWETH redemption agreement, allowing ETH lenders to redeem for wstETH or weETH, restoring liquidity and reducing liquidation risk. The initial capacity limit is $1 billion in ETH.

Morpho: Pauses the MORPHO OFT bridge on Arbitrum; smart contract security remains sound, with risk exposure of only about $1 million (distributed across 2 isolated markets). The fully isolated-market design ensures other Vaults are not affected.

Curve Finance: Pauses the LayerZero infrastructure, affecting the bridging of CRV from chains such as BNB, Sonic, and Avalanche, as well as the rapid bridging of crvUSD (the L2 slow bridge is still functioning normally).

Reserve: Temporarily suspends the minting, rebalancing, and RSR redemptions of eUSD and USD3; the redemption feature remains normally open; ETH+ and bsdETH contain no rsETH collateral, representing zero risk.

Protocols Confirmed Not Affected: Maple Finance (syrupUSDC and syrupUSDT unaffected), Polygon ecosystem (including Katana, Vaultbridge), and EtherFi protocol liquidity vaults have all confirmed there is no loss risk. As a precautionary measure, Hyperwave (the Hyperliquid ecosystem) has temporarily paused LayerZero bridging.

LayerZero Official Statement and Next Steps

LayerZero said it has fully understood the rsETH vulnerability incident, has been actively working with KelpDAO on repairs since the event occurred, and confirmed that other applications remain secure. After obtaining all information, LayerZero plans to jointly publish a complete post-incident analysis report with KelpDAO.

Frequently Asked Questions

How was the attack on the rsETH LayerZero bridge specifically carried out?

The attackers forged LayerZero cross-chain messages, causing the bridge contract to mistakenly treat them as legitimate requests, directly releasing 116,500 rsETH to an address controlled by the attacker. The attack did not directly break the lending protocols themselves, such as Aave; instead, it used the stolen rsETH as collateral to borrow WETH, creating unsecured bad-debt exposure on the protocol’s loan ledger.

What is the current status of rsETH on Aave, and when might it be restored?

rsETH on Aave V3 and V4 is still in a frozen state; WETH reserves are frozen in parallel across the Ethereum, Arbitrum, Base, Mantle, and Linea markets. Aave stated that rsETH on the Ethereum mainnet has full collateral support, but it has not yet announced a clear timeline for restoration. It is currently actively evaluating potential solutions.

Which protocols confirmed they were not affected by this incident?

Polygon ecosystem (including Agglayer, Katana, Vaultbridge), EtherFi protocol liquidity vaults, Maple Finance’s syrupUSDT and syrupUSDC, as well as Reserve’s ETH+ and bsdETH are all confirmed to have no rsETH exposure. All of Morpho’s other Vaults are also confirmed unaffected due to the isolated-market design; only two isolated markets have limited exposure of about $1 million.