{"id":71428,"date":"2026-04-20T23:49:46","date_gmt":"2026-04-20T23:49:46","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/llamarisk-aave-service-providers-detail-kelp-rseth-hack-across-ethereum-and-arbitrum-markets\/"},"modified":"2026-04-20T23:49:46","modified_gmt":"2026-04-20T23:49:46","slug":"llamarisk-aave-service-providers-detail-kelp-rseth-hack-across-ethereum-and-arbitrum-markets","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/llamarisk-aave-service-providers-detail-kelp-rseth-hack-across-ethereum-and-arbitrum-markets\/","title":{"rendered":"Llamarisk, Aave Service Providers Detail Kelp rsETH Hack Across Ethereum and Arbitrum Markets"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<p><strong>Key Takeaways:<\/strong><\/p>\n<ul>\n<li>According to Llamarisk, an attacker exploited Kelp\u2019s Layerzero V2 bridge on April 18, 2026, minting 116,500 rsETH without any corresponding burn.<\/li>\n<li>Llamarisk estimates bad debt between $123.7M and $230.1M across 7 affected markets, depending on how Kelp socializes losses.<\/li>\n<li>The Aave <span>DAO<\/span> treasury holds $181M as of April 20, 2026, and service providers are already securing indicative recovery commitments from ecosystem participants.<\/li>\n<\/ul>\n<h2>Llamarisk Details rsETH Exploit Scenarios After Kelp OFT Adapter Drained<\/h2>\n<p>The <a href=\"https:\/\/governance.aave.com\/t\/rseth-incident-report-april-20-2026\/24580\" target=\"_blank\" rel=\"noopener noreferrer\">analysis<\/a> published by risk management company <a href=\"https:\/\/llamarisk.com\" target=\"_blank\" rel=\"noopener noreferrer\">Llamarisk<\/a> and Aave service provider co-authors explained that the <a href=\"https:\/\/news.bitcoin.com\/zachxbt-flags-280m-kelpdao-exploit-hitting-ethereum-defi-lending-markets\/\">attack<\/a> occurred at 17:35 UTC in Ethereum block 24,908,285. The Unichain-to-Ethereum route was configured as a 1-of-1 DVN path, meaning a single verifier could attest an inbound packet without any corresponding outbound action, according to the report.<\/p>\n<p>Llamarisk authors said the attacker forged a packet that was verified, committed, and delivered on <a href=\"https:\/\/news.bitcoin.com\/ethereum-explained-a-beginners-guide\/\">Ethereum<\/a>, releasing 116,500 rsETH from the adapter, the Aave report notes. The adapter balance fell from 116,723 rsETH to 223 rsETH in a single block. The attacker fanned the stolen rsETH from one intake wallet across seven branch addresses. Of the 116,500 rsETH received, 89,567 were deposited into Aave V3 markets on Ethereum and <a href=\"https:\/\/news.bitcoin.com\/bitso-launches-mexican-peso-stablecoin-on-arbitrum\/\">Arbitrum<\/a> as collateral.<\/p>\n<p>Those positions were used to borrow approximately 82,650 WETH and 821 wstETH, with health factors settling between 1.01 and 1.03. All seven attacker addresses remain active on <a href=\"https:\/\/news.bitcoin.com\/defi-lender-aave-battles-withdrawal-crisis-after-kelpdao-rseth-exploit\/\">Aave<\/a> at the time of publication.<\/p>\n<p>Aave service providers co-authored Llamarisk\u2019s full incident report and confirmed that Aave\u2019s own <span>smart contracts<\/span> were not compromised. All protocol logic, including supply, repayment, and <span>liquidation<\/span> mechanics, continued to function as designed throughout the event.<\/p>\n<p>The Protocol Guardian began freezing all rsETH and wrsETH reserves across all Aave V3 deployments at approximately 19:00 UTC on April 18. The action set LTV to zero and disabled new supply and borrowing while leaving existing positions eligible for repayment and <span>liquidation<\/span>. Eleven markets across Ethereum, Arbitrum, Avalanche, Base, Ink, Linea, Mantle, MegaETH, <a href=\"https:\/\/news.bitcoin.com\/plasmas-mainnet-beta-goes-live-sept-25-with-2b-stablecoin-firepower\/\">Plasma<\/a>, and <a href=\"https:\/\/news.bitcoin.com\/zksync-hacker-returns-stolen-funds-keeps-10-reward\/\">Zksync<\/a> were affected, according to the Aave forum analysis.<\/p>\n<p>The report says the Risk Steward adjusted WETH interest rate models on Arbitrum, Base, Mantle, and Linea at approximately 14:30 UTC on April 19, reducing Slope 2 to 1.50 percent and cutting the borrow rate at 100 percent utilization from between 8.5 and 10.5 percent down to 3.0 percent <span>APR<\/span>. A corresponding adjustment was applied to Core at approximately 05:00 UTC on April 20, with Slope 1 set to 2 percent, Slope 2 to 3 percent, and optimal utilization set to 94 percent.<\/p>\n<p>The Protocol Guardian also froze WETH on Core, Prime, Arbitrum, Base, Mantle, and Linea at approximately 02:00 UTC on April 20 to prevent new borrowing and contain potential stress from spreading to <span>stablecoin<\/span> reserves.<\/p>\n<h2>The 2 Scenarios<\/h2>\n<p>The two scenarios modeled by Llamarisk\u2019s analysis reflect how Kelp\u2019s loss allocation decision will determine the protocol\u2019s final exposure. Scenario 1 assumes uniform socialization of the 112,204 unbacked rsETH across the entire rsETH supply, producing a 15.12 percent depeg and an estimated $123.7 million in bad debt, with Ethereum Core absorbing $91.8 million in absolute terms and <a href=\"https:\/\/news.bitcoin.com\/mantles-mnt-gains-130-in-a-month-traders-eye-3-62-target\/\">Mantle<\/a> facing a 9.54 percent WETH reserve shortfall.<\/p>\n<p>Scenario 2 treats the loss as isolated to <span>L2<\/span> rsETH only, applying a 73.54 percent haircut to collateral on remote chains while leaving Ethereum mainnet rsETH fully intact, producing an estimated $230.1 million in bad debt concentrated on Mantle at a 71.45 percent WETH shortfall and Arbitrum at 26.67 percent.<\/p>\n<p>The current adapter balance stands at 40,373 rsETH, the only confirmed backing for all remote-chain rsETH across every <span>L2<\/span> path, against total remote claims of 152,577 rsETH. Kelp has not publicly confirmed how the recovered funds will be allocated.<\/p>\n<p>As of April 20, 2026, the report said that the Aave <span>DAO<\/span> treasury holds $181 million in assets, including $62 million in Ethereum-correlated holdings, $54 million in AAVE, and $52 million in <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-are-stablecoins\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">stablecoins<\/a>. The <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-a-dao\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">DAO<\/a> generated $145 million in revenue during 2025 and $38 million year-to-date in 2026. Llamarisk confirmed that several indicative commitments from ecosystem participants are already in place to address potential bad-debt scenarios.<\/p>\n<p>WETH reserves on Ethereum, Arbitrum, Base, <a href=\"https:\/\/news.bitcoin.com\/sharplink-deploys-170-million-eth-into-linea-kicks-off-ethereums-productive-era\/\">Linea<\/a>, and Mantle are at 100 percent utilization, with idle balances below $20 on every chain. At full utilization, liquidators receive aWETH rather than underlying WETH, which slows <a href=\"http:\/\/www.bitcoin.com\/get-started\/understanding-liquidation-on-perp-dex\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">liquidation<\/a> throughput.<\/p>\n<p>Llamarisk\u2019s report flagged Base and Arbitrum as the least buffered markets, with first liquidations triggered at WETH price drops of 0.77 percent and 1.77 percent, respectively, due to positions running at health factors around 1.03.<\/p>\n<p>Llamarisk recommended an immediate pause of the WETH Umbrella <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-staking\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">staking<\/a> module under Scenario 1. As of the report\u2019s publication, 18,922 of 23,507 staked aWETH had entered the unstaking cooldown.<\/p>\n<p>A pause would block deposits, withdrawals, transfers, and slashing while keeping rewards distribution active. The remaining four rsETH-listed markets, Ethereum Lido, MegaETH, Plasma, and Zksync, carry trivial balances and no bad debt. Twelve additional Aave V3 markets do not list rsETH and are unaffected.<\/p>\n<\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/incident-report-llamarisk-aave-service-providers-detail-kelp-rseth-hack-across-ethereum-and-arbitrum-markets\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways: According to Llamarisk, an attacker exploited Kelp\u2019s Layerzero V2 bridge on April 18, 2026, minting 116,500 rsETH without any corresponding burn. Llamarisk estimates bad debt between $123.7M and $230.1M across 7 affected markets, depending on how Kelp socializes losses. The Aave DAO treasury holds $181M as [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":71429,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/71428"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=71428"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/71428\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/71429"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=71428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=71428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=71428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}