This Week’s Top Stories
Listen to the Weekly Wrap on Spotify and Apple Podcasts. It is a summary with the help of AI-voices.
This Week’s Top Stories
“KelpDAO’s rsETH bridge exploited for roughly $290 million.” Saturday, 18 April 2026
- Over the past weekend, a hacker exploited a vulnerability in KelpDAO's LayerZero-powered rsETH bridge.
- The attacker tricked the bridge into minting ~116'500 rsETH out of thin air on Ethereum mainnet (worth ~$292 million at the time). This represented roughly 18 percent of the entire rsETH supply.
- The attacker immediately deposited this unbacked (worthless) rsETH as collateral on Aave and borrowed large amounts of WETH (since the LTV for rsETH was high, close to 1:1).
- The exploit left Aave with approximately $177–196 million in bad debt (the collateral is effectively worthless and cannot be liquidated profitably).
- This triggered a massive panic: over $6.6–8.45 billion in withdrawals from Aave in the first 48 hours after the hack. Many pools (especially WETH) hit 100% utilization, meaning suppliers and lenders cannot withdraw their funds right now because all available liquidity has been borrowed out. Users are stuck until borrowers repay or new liquidity enters the protocol.
- Aave has frozen the rsETH markets on V3 and V4 to contain the damage. The protocol itself was not directly hacked, this stemmed entirely from the KelpDAO bridge exploit.
- On Monday, the Arbitrum Security Council took emergency action to freeze the 30'766 ETH being held in the address on Arbitrum One that is connected to the exploit. It identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users. Dragonfly Partner Haseeb explained that Arbitrum used a privileged "Type 101" ArbOS transaction to forcibly claw back the ETH from the hacker. This system-level move completely bypassed the attacker's private key without requiring a chain reorg.
- In the meantime, the hacker has swapped nearly all of the remaining 75'700 ETH holdings, worth about $175 million, into BTC. The cross-chain swaps were primarily routed through THORChain.
- Aave's TVL dropped by roughly 45 percent, seeing outflows of $12 billion since the exploit happened last Saturday.






