LayerZero L2 Bridge Triggers $300M rsETH Release; Aave Freezes Markets

KelpDAO tokens worth roughly $292 million were released onto Ethereum through a LayerZero L2 bridge and then moved into Aave, where the protocol froze rsETH markets on V3 and V4. The incident began when a wallet funded through Tornado Cash’s 1 ETH pool waited about ten hours and then called lzReceive on LayerZero’s EndpointV2 contract, which triggered KelpDAO’s bridge logic and released about 116,500 rsETH to the attacker’s address.

Two additional bridge packets attempting about 40,000 rsETH each were submitted but reverted after KelpDAO’s emergency multisig activated a global pauseAll, limiting further token releases. If those packets had succeeded, total releases would have reached about $391 million.

The attacker used the stolen rsETH as collateral on Aave V3 and borrowed large amounts of ETH and WETH. Some borrowed funds were routed back through Tornado Cash. Early exposure estimates at Aave reached as high as $177 million. Aave noted the issue is with rsETH rather than its own contracts and confirmed precautionary actions: “Out of an abundance of caution, rsETH remains frozen across Aave V3 and V4 and exposure to the incident is capped. WETH reserves also remain frozen across affected markets,” adding that teams are validating information and assessing possible resolutions. WETH reserves were halted on Ethereum, Arbitrum, Base, Mantle, and Linea.

Several other protocols paused or limited rsETH activity. SparkLend closed its rsETH market, Fluid froze activity, and Upshift paused High Growth ETH and Kelp Gain vaults. Products connected to Pendle, Compound, Euler, Beefy, and Yearn showed exposure. Many teams withheld oracle updates because delayed price feeds could cause unfair minting of shares; deposits were frozen in some venues for the same reason. One participant wrote, “We just don’t know how to price rsETH.”

Preliminary technical findings point to a bridge configuration issue on the Unichain-to-Ethereum route: a 1-of-1 decentralized validator node (DVN) reportedly allowed tokens to be released without evidence of a source-side burn. Other implementations use at least a 2-of-2 DVN arrangement, increase to three on busier routes, and apply inbound and outbound rate limits. At least one platform paused all LayerZero OFT bridges and froze its Teller contract, which manages deposits, withdrawals, and share minting.

Market effects included a spike in borrow rates on Aave and congestion in the Ethereum exit queue, which made deleveraging costlier. Protocols reported difficulty processing withdrawals despite controls remaining technically open. Projections of potential losses vary: one estimate put the impact at about 9,000 ETH in a worst case, while another estimated a roughly 6.2% hit to top-level depositors if losses reached Layer 1 and backstops were not used. Some teams expect incoming liquidity to arrive within days to help satisfy larger withdrawal requests.

EtherFi posted that its Liquid vaults were unaffected and that liquid vault users would not see drawdowns. Other liquid staking services reported limited ability to exit positions because swap premiums and the exit queue made conversions costly.

Separately, Vercel identified an unrelated security incident involving unauthorized access to internal systems and reported that certain customer data and code had been exposed and listed for sale.

Investigations into the rsETH release remain active. Multiple teams, including KelpDAO and Aave, are coordinating to restore oracle pricing, assess exposures, and determine steps for recovery or compensation.