Aave Loses $230M in rsETH Exploit Caused by KelpDAO LayerZero Bridge Failure

Aave published an official postmortem on June 1, 2026, attributing the record $230 million rsETH exploit to a failure in KelpDAO’s LayerZero-powered bridge rather than any bug in its own smart contracts. The postmortem detailed how attackers abused a single LayerZero verifier to forge a cross-chain message, minting 116,500 unbacked rsETH on Ethereum.

Those tokens were deposited into Aave and used to take out loans that could not be recovered.

KelpDAO is a restaking service that lets users reuse staked ether as collateral, with rsETH representing a claim on that restaked ether. KelpDAO uses LayerZero to move rsETH between blockchains. Aave said it is launching a review of every asset listed on V3 and rewriting its listing standards.

The protocol plans to overhaul its risk framework to scrutinize bridges, oracles, custodians and operational security. Aave is also building automated defenses that can instantly strip collateral of borrowing power once predefined risk thresholds are breached.

Since the exploit, the protocol has already executed roughly 295 parameter changes across V3 markets, including 168 supply-cap reductions and 66 borrow-cap reductions.

LayerZero acknowledged earlier in May 2026 that it made a mistake by allowing its verification system to secure high-value assets in a one-of-one configuration.