News linked to both this project and an event.
Aave risk service provider LlamaRisk has released an incident report: On April 18, 2026, the attacker exploited a vulnerability in Kelp’s LayerZero V2 Unichain-to-Ethereum rsETH routing (a 1-of-1 DVN configuration flaw), forged inbound packets, and illicitly released 116,500 rsETH from the Ethereum-side adapter. Of these, 89,567 rsETH were deposited as collateral into multiple Aave V3 markets—including Ethereum Core and Arbitrum—enabling the borrowing of approximately 82,650 WETH (valued at ~$191 million) and 821 wstETH. Currently, only 40,373 rsETH remain in the adapter, while the total claimable rsETH on the remote chain stands at 152,577—creating a substantial shortfall. Depending on the loss allocation methodology, Aave faces two potential bad-debt scenarios: - Scenario 1 (global pro-rata allocation): Estimated bad debt of ~$123.7 million, with Ethereum Core bearing the greatest pressure; - Scenario 2 (loss confined to L2s): Estimated bad debt of ~$230.1 million, with Mantle facing a WETH reserve shortfall of up to 71.45% and Arbitrum facing a 26.67% shortfall. Following the incident, Aave Protocol Guardians and Risk Administrators immediately froze rsETH/wrsETH reserves across all 11 affected markets.
According to an official post on Ethena’s X account, due to the absence of a satisfactory root-cause analysis regarding the rsETH incident, Ethena has decided to extend the suspension period for its LayerZero OFT cross-chain bridge. Meanwhile, Ethena released its latest Proof of Reserves, independently verified by four third-party entities—Chainlink, Chaos Labs, LlamaRisk, and Harris & Trotter—confirming that USDe’s collateral coverage ratio remains above 100%. The verification results have been published on Ethena’s Transparency Page and Data Dashboard. Ethena stated it will continue monitoring the situation and provide updates as they become available.