A Massive $290 Million Hack: How Did the Exploit Unfold?
The surprise attack was executed with surgical precision. By exploiting a flaw in KelpDAO’s cross-chain bridge, the hacker successfully minted over 116,500 rsETH tokens artificially. This massive manipulation allowed them to create the equivalent of $290 million out of thin air, using a compromised LayerZero contract.
Immediately after, these counterfeit tokens were deposited as collateral on Aave’s V3 lending markets, operating on Ethereum and Arbitrum. The attacker was then able to borrow over $280 million in real WETH and ETH before liquidators could react. This maneuver left the protocol with a colossal bad debt.
Faced with this hemorrhage, the market reacted swiftly. The shockwave caused the LayerZero (ZRO) token to plummet by 20% overnight. Currently trading at $1.60, it has recovered 10% from its low of $1.42.
Aave and the AAVE Token in Freefall: A Bearish Sentiment Takes Hold
The AAVE token is another victim of this latest DeFi hack. The AAVE token suffered a violent correction, plunging by more than 10% in the hours following the announcement. Renowned on-chain sleuth ZachXBT quickly highlighted the fund movements, confirming that the loot had been laundered through Tornado Cash to cover the tracks.
To limit the damage, the Aave teams urgently froze all rsETH markets. Although Aave’s smart contracts were not directly hacked, the protocol is left with a gaping hole in its WETH reserves. The “Umbrella” safety module is expected to be activated to absorb this debt, but investor confidence has been severely shaken.
Renowned on-chain detective ZachXBT was the first to shed light on the suspicious movements via his Telegram channel, confirming in real time the draining of over $280 million and the link to Tornado Cash. “KelpDAO apparently got hacked for $280M+ an hour ago on Ethereum and Arbitrum,” he alerted, providing on-chain addresses that accelerated the community’s response.
On Aave’s side, founder and CEO Stani Kulechov reacted almost immediately on X: he confirmed the freezing of the rsETH markets (“the asset has no borrowing power”) and assured that Aave V3 and V4 had “no further exposure” to rsETH, while pointing to a governance discussion to manage the potential debt.
KelpDAO has since published an official statement on X, indicating that they are investigating alongside LayerZero, Unichain, their auditors, and security experts. LayerZero, for its part, stated it is actively working with KelpDAO on remediation, affirming that other applications remain secure, and promised a full post-mortem with SEAL_Org.
This heavy blow shatters the positive momentum that had been prevailing in DeFi, and especially for the ZRO token. While many hoped they had found the next DeFi gem, this hack puts a sudden halt to the euphoria surrounding the token, which had posted remarkable performances since the beginning of the year. Now, trust is eroded, and it is hard to regain when a hack of this magnitude unfolds without warning.
Can DeFi Cryptos Bounce Back and Target a New ATH?
Despite the scale of this massive hack, the Ethereum ecosystem has already proven its resilience in the past. Developers are working relentlessly to patch the vulnerabilities and reassure institutional investors. If the emergency measures prove effective, this crisis could be nothing more than a mere bump in the road toward a future bull run.
However, the question of cross-chain bridge security remains unresolved. Users now demand stronger guarantees before committing their capital. The ability of protocols to innovate without compromising security will define the next market trend.
As prices attempt to stabilize, investors are looking to the future. Will this shock cleanse the market, or does it mark the beginning of a deeper crisis for Aave, ZRO, Arbitrum, and the entire Ethereum DeFi ecosystem?
Sources:
Related Articles:
