{"id":28459,"date":"2026-04-19T10:26:00","date_gmt":"2026-04-19T09:26:00","guid":{"rendered":"https:\/\/investx.fr\/en\/?p=28459"},"modified":"2026-04-19T12:32:14","modified_gmt":"2026-04-19T11:32:14","slug":"ethereum-arbitrum-hack-aave-zro","status":"publish","type":"post","link":"https:\/\/investx.fr\/en\/crypto-news\/ethereum-arbitrum-hack-aave-zro\/","title":{"rendered":"Ethereum and Arbitrum hit by $290M hack: AAVE and LayerZero (ZRO) plunge"},"content":{"rendered":"\n

A Massive $290 Million Hack: How Did the Exploit Unfold?<\/h2>\n\n\n\n

The surprise attack was executed with surgical precision. By exploiting a flaw in KelpDAO’s cross-chain bridge<\/strong>, the hacker successfully minted over 116,500 rsETH tokens artificially. This massive manipulation allowed them to create the equivalent of $290 million out of thin air, using a compromised LayerZero contract.<\/strong><\/p>\n\n\n\n

Immediately after, these counterfeit tokens were deposited as collateral on Aave’s V3 lending markets, operating on Ethereum<\/a><\/strong> and Arbitrum<\/strong>. The attacker was then able to borrow over $280 million in real WETH and ETH before liquidators could react. This maneuver left the protocol with a colossal bad debt.<\/p>\n\n\n\n

\"ZRO<\/figure>\n\n\n\n

Faced with this hemorrhage, the market reacted swiftly. The shockwave caused the LayerZero (ZRO) token to plummet by 20%<\/strong> overnight. Currently trading at $1.60<\/strong>, it has recovered 10% from its low of $1.42.<\/strong><\/p>\n\n\n\n

Aave and the AAVE Token in Freefall: A Bearish Sentiment Takes Hold<\/h2>\n\n\n\n

The AAVE token is another victim of this latest DeFi hack. The AAVE token suffered a violent correction<\/strong>, plunging by more than 10%<\/strong> in the hours following the announcement. Renowned on-chain sleuth ZachXBT quickly highlighted the fund movements, confirming that the loot had been laundered through Tornado Cash<\/strong> to cover the tracks.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

To limit the damage, the Aave teams urgently froze all rsETH markets. Although Aave’s smart contracts were not directly hacked, the protocol is left with a gaping hole in its WETH reserves. The “Umbrella” safety module is expected to be activated to absorb this debt, but investor confidence has been severely shaken.<\/p>\n\n\n\n

\n

According to @zachxbt<\/a> , a victim appears to have had $280M+ stolen from various DeFi protocls one hour ago on Ethereum and Arbitrum.

The attack addresses were funded via Tornado Cash.

Theft addresses:
0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc|\u2026<\/p>— Vladimir S. | Officer's Notes (@officer_secret) April 18, 2026<\/a><\/blockquote>