KelpDAO rsETH Bridge Vulnerability Attacked, 116,500 rsETH Minted Leading to Losses of Approximately $293 Million
KelpDAO's rsETH bridging protocol (based on LayerZero Omnichain Fungible Token standard) experienced a vulnerability early this morning, allowing attackers to mint approximately 116,500 uncollateralized rsETH, resulting in losses of about $293 million.
The attackers deposited most of the rsETH into Aave as collateral to borrow ETH, while a small portion was directly sold for ETH, ultimately obtaining around 106,500 ETH (valued at approximately $250 million) through collateralization and selling. This incident led to bad debts in Aave's WETH reserves, and the protocol has frozen the rsETH-related markets to assess risks.
Source: Public Information
ABAB AI Insight
此次攻击暴露桥接协议在跨链铸造机制下的风险控制薄弱点。rsETH作为流动再质押代币，本依赖底层ETH质押与再质押收益背书，LayerZero OFT标准允许跨链转移却未能完全阻挡未授权铸造路径，导致攻击者快速生成无抵押资产并在Aave等借贷平台放大杠杆提取价值。这种向量与历史多起桥接攻击类似，凸显跨链设计中信任假设与实际执行间的结构性缺口。
从DeFi长期结构看，这一事件加速协议对抵押品风险参数的重新校准。rsETH此前因有机需求成为Aave主要ETH抵押资产之一，供应快速增长伴随上限提升；但单一漏洞即可引发大规模坏账，迫使平台通过冻结和潜在清算机制（如Umbrella模块扣除质押者）吸收损失，强化资本效率与安全之间的权衡，同时推动流动性向审计更严、机制更隔离的协议迁移。
在全球金融与财富分配层面，此类黑客事件体现技术替代与制度约束的张力。攻击者低成本利用漏洞提取巨额ETH，完成从协议到个人的快速财富转移，而剩余持有者和流动性提供者承担坏账与信心打击。长期而言，它对应激励机制向更强风险隔离和实时监控倾斜，促使资本在DeFi生态内从高收益桥接/再质押项目向低杠杆、强治理用例的重新配置，影响跨周期的行业集中与生产率稳定。