In a significant stride toward recovery, Aave and Kelp have successfully executed the initial phase of their recovery strategy by burning attacker-managed rsETH tokens on Arbitrum as of May 12. This action represents a vital step in addressing the breach from April, which exploited a flaw in the LayerZero bridge. The attack led to the creation of over 116,000 unbacked rsETH tokens, causing substantial disruption to the cryptosphere.
What happened during the breach?
The breach in April capitalized on a vulnerability in the LayerZero bridge, linking Kelp’s Unichain and Ethereum. Leveraging this flaw, the intruder managed to produce 116,500 illegitimate rsETH and transferred them to Ethereum. A key issue was the bridge’s single-approval verification, allowing for cross-chain transfers via a deceitful claim. This statement alleged that the rsETH had been burned on the source chain, thus misleadingly minting new tokens.
The attacker used these rsETH tokens as collateral on Aave’s V3 platform, resulting in borrowing WETH and wstETH worth between $190 million and $236 million. This led to a staggering $292 million in bad debt within the system, with unbacked rsETH tokens extensively circulating.
How did the recovery coalition act?
In the aftermath, the DeFi United coalition quickly mobilized to recover and stabilize the system without passing the losses to users. Major participants like Lido, EtherFi, LayerZero, Golem, Ethena, Mantle, and Aave’s founder, Stani Kulechov, pledged over $327 million in ETH to the cause.
A significant recovery move involved liquidating the attacker’s frozen Aave funds. This proposal passed with overwhelming approval during the protocol’s DAO vote. Additionally, a U.S. court approved the transfer of approximately $71 million to an Aave-managed wallet.
Future implications and the market’s direction?
Following the May 12 burn, all unbacked rsETH tokens were eradicated from circulation. Plans to transfer 117,132 rsETH to the mainnet LayerZero OFT adapter are underway, predicted over the coming weeks.
Stani Kulechov noted that replenishing the rsETH vault is imminent, with rsETH to ETH withdrawals set to resume swiftly, aiming for market stability.
Aave’s total value locked (TVL) remains north of $15 billion despite facing $10 billion in immediate outflow post-exploit. Utilization rates for key cryptocurrencies have also steadied, signaling reduced withdrawal pressure.
Distinct from past DeFi breaches, this recovery was purely on-chain. Diverging from reliance on outside funds in previous cases, this effort involved isolating and liquidating the attacker’s holdings, replenishing reserves through coordinated support.
The involvement of a federal court further underscores the unique nature of this recovery in the evolving DeFi landscape, marking it as a precedent-setting event requiring legal navigation.
