Kelp DAO Suffers $292 Million Attack, Aave Urgently Freezes rsETH Market

According to BroadChain, at 23:16 on April 19, Bitcoinist reported that Kelp DAO suffered a large-scale cross-chain attack, losing approximately 116,500 rsETH, valued at nearly $292 million. The attacker exploited a vulnerability in the "Iz Receive" function of LayerZero EndpointV2, using Tornado Cash to provide initial funds. On-chain investigator ZachXBT estimated the losses to exceed $280 million. Kelp DAO has suspended the rsETH contracts on the mainnet and multiple L2 networks and is conducting an investigation with LayerZero, Unichain, and auditors. The attacker subsequently attempted two more times to steal an additional 40,000 rsETH worth about $100 million, but both attempts were intercepted, preventing total losses from rising to $391 million. Affected by the incident, Aave has preemptively frozen the rsETH market in its V3 and V4 versions, emphasizing that its own contracts were not attacked. As a liquid staking token, the stolen assets account for approximately 18% of rsETH's circulating supply, dealing a significant blow to liquidity and user confidence.