News section

Aave required a governance process to manipulate its rsETH oracle price to generate a deficit in the attacker’s fraudulent position.The move was part of a previously announced recovery plan, which is working to restore rsETH’s backing and compensate affected users.

Kelp DAO will use Chainlink’s Cross-Chain Interoperability Protocol (CCIP), which requires 16 independent node operators to validate cross-chain transactions.Many onlookers blame LayerZero at least partially for the attack because its default setup for the cross-chain bridge that was attacked used a 1-of-1 configuration.

Kelp DAO is moving rsETH to Chainlink CCIP after April’s $292 million bridge exploit.LayerZero denied Kelp’s claims and said rsETH manually changed to a 1-of-1 setup.Aave is fighting a restraining notice over frozen ETH tied to the rsETH hack.

The protocol shift comes as a $71 million court fight continues to unfold.

A federal case over frozen crypto could determine whether DeFi recovery funds can be seized to satisfy unrelated judgments.

This is the main section from the 50th edition of The Funding sent to our subscribers on May 3.The Funding is a fortnightly newsletter written by Yogita Khatri, The Block’s longest-serving editorial member.To subscribe to the free newsletter, click here.

LayerZero, the infrastructure provider that some onlookers say is partially at fault for the $292 million Kelp DAO attack, will contribute 10,000 ETH and other support to the DeFi United initiative.Kelp says it used the default configuration for its LayerZero-powered Decentralized Verifier Network that was exploited.

JPMorgan analysts said DeFi hacks, including the recent Kelp DAO exploit, and stagnant TVL in ETH terms continue to limit institutional interest in DeFi.The analysts said persistent hacks appear to push investors toward Tether’s USDT stablecoin, as users move funds out of DeFi during stress.

Flying Tulip has added a circuit breaker to slow or queue withdrawals during abnormal outflows as April DeFi losses surged.More than $600 million was lost in DeFi exploits in April alone, with two incidents accounting for about 95% of the total.

Attackers drained 116,500 rsETH worth approximately $290 million from KelpDAO’s LayerZero-powered bridge on April 18 in 2026’s largest DeFi exploit to date.LayerZero has attributed the attack with preliminary confidence to North Korea’s Lazarus Group, specifically its TraderTraitor subunit.The fallout triggered over $13 billion in outflows from DeFi platforms including Aave, which froze rsETH markets on both its V3 and V4 deployments.

KelpDAO’s exploiter is moving roughly $300 million in stolen funds through Arbitrum and into Tron-based USDT.The hack could cool Wall Street’s appetite for blockchain and tokenization deals.SlowMist flags new “MacSync Stealer” macOS malware draining crypto wallets, compounding security fears.

Curve’s Michael Egorov says many DeFi hacks stem from avoidable centralized weak points.He cites the KelpDAO rsETH exploit and Aave’s response as a systemic warning.Egorov wants Ethereum and Solana foundations to help lead common security standards.

The Arbitrum Security Council has frozen 30,766 ETH held in an address on Arbitrum One linked to the Kelp DAO exploit.Arbitrum said the frozen funds will only be moved by further action through Arbitrum governance.

Kelp DAO has countered LayerZero’s earlier statement, saying the 1-of-1 DVN setup under criticism was shipped as the default at LayerZero.Aave released a new report evaluating two potential bad debt scenarios resulting from the $292 million exploit on Kelp.

The first scenario is far cheaper but runs the risk of rsETH depegging an estimated 15%, while the second is costlier but better protects Ethereum mainnet and concentrates losses at the layer 2 level.

The DeFi sector posted a 5.6% single-day drawdown — among the most severe moves since 2024.Kelp Dao, Aave and LayerZero are pointing the finger at each other and it is still unclear how losses will be distributed.