A staggering $292 million exploit has sent shockwaves through the cryptocurrency industry, exposing weaknesses in decentralized finance infrastructure and sparking concerns about the ripple effects on lending protocols. The attack, which targeted Kelp's rsETH token, a yield-bearing version of ether, manipulated the system to create large amounts of unbacked tokens, which were then used as collateral to drain real assets from lending markets, primarily Aave. This incident is the latest in a series of blows to DeFi, coming just weeks after the $285 million exploit of Solana-based protocol Drift, further eroding investor trust in the nearly $90 billion crypto sector. The exploit centered on a LayerZero bridge component, which enables assets to move across different blockchains, and was made possible by a single-signer setup that relied on one entity to approve transactions.
The attacker was able to sign a message, allowing them to mint large amounts of rsETH, although it remains unclear how they obtained access. This setup allowed the attacker to create unbacked tokens, which were then deployed to lending protocols, mostly Aave, to borrow real ETH against.
The maneuver has left DeFi lending platforms holding collateral that may be difficult to unwind, while valuable and liquid assets have already been drained. Aave saw a significant drop in assets on the protocol, with users withdrawing their assets following the incident. Key questions remain around how the validator was compromised, with uncertainty over whether it was hacked, misconfigured, or misled.
The attacker's identity is also unknown, although the scale of the attack suggests a sophisticated actor. The exploit serves as a reminder that as DeFi grows more interconnected, failures in one layer can quickly cascade across the system.
The incident has raised concerns about the potential for a 'bank run' dynamic, as users rush to withdraw funds. Despite the challenges, some experts believe that DeFi will learn from this incident and become stronger than before.