#rsETH攻擊事件後續進展

On April 18, 2026, a major security incident occurred involving rsETH, the liquidity re-staking token under Kelp DAO, which subsequently triggered a severe systemic bad debt crisis in DeFi history. The latest developments as of April 26, 2026 are as follows:
Event core and current status
Loss scale: Hackers exploited a configuration vulnerability in the LayerZero cross-chain bridge's 1/1 DVN ( single-signature verification ) setup, forging instructions to mint 116,500 rsETH (approximately $292 million).
Funds flow: The hackers deposited these unbacked "air rsETH" into lending protocols like Aave V3 as collateral, borrowing real assets worth about $190 million (such as wETH), leading to bad debts in Aave of approximately $177 million to $200 million.
Current measures: rsETH-related contracts are currently frozen on the Ethereum mainnet and multiple L2s (such as Arbitrum, Base, Mantle). Aave has paused the rsETH market to prevent further losses.

Rescue and compensation progress: DeFi United mechanism
To restore rsETH asset backing, multiple protocols have initiated coordinated actions:
DeFi United mechanism established: Led by Aave, in cooperation with several protocols to jointly rescue, aiming to fill a gap of about $258 million.
Funding commitments: As of April 24, the mechanism has received about $101 million in intent commitments, with some protocols entering DAO voting stages.
Recovery fund activation: The latest reports indicate that Aave activated a recovery fund on April 26, aimed at restoring full asset backing for rsETH.

Potential handling paths (under discussion)
Analysts (such as DefiLlama founder 0xngmi) have proposed three main recovery paths, which are not yet finalized:
Option 1: Full write-down: All rsETH holders share the loss, with assets expected to face about an 18.5% devaluation.
Option 2: Abandon L2 solution: Only safeguard rsETH on the Ethereum mainnet, leaving L2 holders to bear losses themselves (this could trigger ecosystem collapse on L2).
Option 3: Snapshot compensation: Only compensate "true owners" before the attack, but this is extremely difficult to implement under DeFi pooling structures.

Responsibility tracking and technical investigation
Hacker identity: Initial reports on the LayerZero incident suggest the attacker is affiliated with North Korean hacker group Lazarus Group's sub-team TraderTraitor.
Technical vulnerability: Not due to contract code errors, but because Kelp DAO configured an overly fragile "single verification node." Hackers used DDoS attacks to disable normal RPC nodes, forcing the system to switch to nodes controlled by the hackers to read forged data.

If you hold affected assets, it is recommended to monitor:
Kelp DAO official community for exact snapshot timing and compensation claim details.
Aave Governance forum for voting results on the "DeFi United" specific funding progress.
$ETH $BTC $DOGE