Attack on the LayerZero bridge
Attackers exploited the rsETH cross-border bridge of the Kelp DAO via LayerZero, resulting in a withdrawal of 116,500 rsETH (~292 million dollars) through fake cross-border messages, representing the largest DeFi breach in 2026.
The crisis of the attack on Aave
The hackers deposited the stolen rsETH into Aave to borrow 236 million dollars worth of ETH, leading to the formation of bad debts ranging from 177 to 200 million dollars. The total mass withdrawals from Aave amounted to 6.6 billion dollars, and the AAVE token dropped by 18%.
Revealing systemic risks
The event highlighted the risks of uncollateralized lending and the pitfalls of DVN formation. Multiple protocols have paused LayerZero bridges, while the ZRO token has dropped by 18% amidst a confidence crisis.
