# Exploit Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Exploit", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

The $290 Million Deficit: A Three-Way Game Between Aave, L0, and Kelp—Who Should Foot the Bill?

An incident involving the theft of 116,500 rsETH (worth approximately $290 million) from Kelp DAO’s cross-chain bridge contract has triggered a complex dispute over responsibility and compensation among Kelp DAO, LayerZero, and Aave. The attack occurred due to a compromised RPC provider used by LayerZero’s Decentralized Verifier Network (DVN). Since Kelp DAO’s bridge used a 1/1 DVN configuration—a single point of failure—the attacker successfully forged a cross-chain message, leading to the unauthorized release of rsETH tokens from the mainnet. These genuine tokens were then deposited into Aave and other lending platforms to borrow WETH, enabling the attacker to exit with the funds. Responsibility is attributed primarily to Kelp DAO for its risky 1/1 DVN setup. LayerZero bears secondary responsibility for permitting such a vulnerable configuration in its protocol layer. Aave also shares indirect blame for over-collateralizing rsETH and other Liquid Restaking Token (LRT) assets without adequate ongoing risk oversight. Kelp DAO lacks sufficient funds to cover the loss, shifting focus to the deeper-pocketed players: LayerZero, whose cross-chain ecosystem and reputation are at risk, and Aave, which faces massive bad loans and declining Total Value Locked (TVL). Aave has asserted that mainnet rsETH remains fully backed, implying it expects Kelp DAO to allow redemption of underlying ETH. This approach would preserve Aave’s mainnet positions but invalidate Layer2 rsETH, damaging LayerZero’s cross-chain credibility. Potential solutions include: - A universal 18.5% haircut on all rsETH holders, causing significant Aave bad debt. - Writing off Layer2 rsETH entirely, protecting Aave mainnet but harming LayerZero and Kelp DAO. - Negotiating a bounty with the hacker for partial fund return. - A joint bailout, possibly led by LayerZero’s ecosystem fund, given its long-term stake in the cross-chain ecosystem. The situation remains unresolved as the parties negotiate, but prolonged delay risks broader DeFi instability, including potential liquidity crises and loss of confidence in LRT and cross-chain infrastructures.

Odaily星球日报04/20 08:52

The $290 Million Deficit: A Three-Way Game Between Aave, L0, and Kelp—Who Should Foot the Bill?

Odaily星球日报04/20 08:52

Kelp DAO Suffers $292 Million rsETH Exploit – Details

Kelp DAO has suffered a major cross-chain exploit resulting in the loss of approximately 116,500 rsETH, valued at nearly $292 million. The attack targeted a vulnerability in the protocol's cross-chain bridge mechanism, specifically through LayerZero’s EndpointV2. On-chain investigator ZachXBT first identified the breach, noting that the attacker used Tornado Cash to conceal funding sources. In response, Kelp DAO immediately paused all rsETH contracts across mainnet and Layer-2 networks, preventing two additional attempts to drain another $100 million in assets. The protocol is collaborating with LayerZero and Unichain for a full investigation. The incident has impacted the broader DeFi ecosystem, leading Aave to freeze rsETH markets on its V3 and V4 deployments as a precaution, though its own contracts remain secure. The stolen rsETH represents around 18% of its circulating supply, significantly damaging liquidity and user confidence.

bitcoinist04/19 22:33

Kelp DAO Suffers $292 Million rsETH Exploit – Details

bitcoinist04/19 22:33

DeFi Hacked Again for $292 Million, Is Even Aave No Longer Safe?

On April 19, a major DeFi security breach occurred, resulting in the loss of approximately $292 million. The attack targeted Kelp DAO’s rsETH bridge contract built on LayerZero, with 116,500 rsETH stolen. The attacker initiated the exploit using funds from Tornado Cash and manipulated the LayerZero EndpointV2 contract to transfer the assets. Kelp DAO confirmed the incident and temporarily paused rsETH contracts across multiple networks while collaborating with security experts for investigation. Initial analysis suggests the root cause was a compromised private key on the source chain, with the contract secured by only a 1/1 validator set, making it vulnerable to a single malicious transaction. The attacker used the stolen rsETH as collateral on lending platforms—including Aave, Compound, and Euler—to borrow more liquid assets like WETH, accumulating over $236 million in debt. Aave alone accounted for $196 million of this amount. In response, Aave froze its rsETH markets and stated it would explore covering potential bad debt through its Umbrella safety module, which holds around $50 million in WETH. This incident follows another large exploit earlier in April, where Drift Protocol on Solana lost $280 million. The repeated high-value attacks raise concerns about DeFi security, even affecting major protocols like Aave. Users are advised to exercise caution, diversify holdings, and limit exposure to on-chain protocols until more robust security measures are established.

marsbit04/18 23:31

DeFi Hacked Again for $292 Million, Is Even Aave No Longer Safe?

marsbit04/18 23:31

DeFi Hacked Again, Losing $292 Million: Is Even Aave No Longer Safe?

On April 19, DeFi suffered another major security breach, with liquid staking protocol Kelp DAO losing approximately 116,500 rsETH (worth around $292 million) due to an exploit in its LayerZero-based bridge contract. The attack originated from a compromised private key on the source chain, allowing the hacker to initiate unauthorized transfer via a single validator. The attacker used the stolen rsETH as collateral on lending platforms including Aave, Compound, and Euler to borrow more liquid assets like wETH, resulting in over $236 million in debt—$196 million from Aave alone. Aave quickly froze its rsETH markets and announced it would explore covering potential bad debt through its Umbrella safety module, which holds about $50 million in WETH. This incident follows a $280 million exploit on Solana’s Drift Protocol earlier in April, raising further concerns about DeFi security. Even established protocols like Aave are now indirectly exposed, prompting warnings for users to diversify holdings and limit exposure to smart contract risks. Investigations are ongoing.

Odaily星球日报04/18 23:24

DeFi Hacked Again, Losing $292 Million: Is Even Aave No Longer Safe?

Odaily星球日报04/18 23:24

1 Billion DOT Minted Out of Thin Air, Yet Hacker Only Made $230,000

On April 13, a security breach occurred involving the Polkadot bridge on the Ethereum network, where an attacker exploited a replay vulnerability in the MMR proof mechanism of Hyperbridge’s ISMP protocol. By reusing a historically valid proof and pairing it with a malicious request, the attacker bypassed verification and gained admin and minting rights over the wrapped DOT contract on Ethereum. They then minted 1 billion wrapped DOT tokens—2,805 times the existing supply—and attempted to liquidate them. However, due to extremely low liquidity in the wrapped DOT market, the massive sell-off crashed the token’s price by 99.98%, from $1.22 to approximately $0.000128. The attacker ultimately exchanged the tokens for only about 108.2 ETH (worth roughly $237,000), with gas costs as low as $0.74. The same exploit had been used previously in attacks on MANTA and CERE tokens, resulting in a total loss of around $242,000. Polkadot confirmed that the incident only affected DOT bridged via Hyperbridge to Ethereum and did not impact the native Polkadot network or DOT on other bridges. Exchanges including Upbit and Bithumb temporarily suspended DOT deposits and withdrawals as a precaution. The event highlights ongoing vulnerabilities in cross-chain infrastructure and the critical role of liquidity in limiting actual damages during large-scale exploits. It also reflects a broader trend of increasing DeFi security incidents in early 2026.

marsbit04/13 10:10

1 Billion DOT Minted Out of Thin Air, Yet Hacker Only Made $230,000

marsbit04/13 10:10

Circle defends USDC freeze policy after Drift exploit, calls for faster legal frameworks

Circle has responded to criticism regarding its handling of illicit funds, particularly after the Drift Protocol exploit where over $270 million was drained. The company stated that it cannot freeze USDC assets without legal authorization from relevant authorities, emphasizing that freezing is a legal obligation, not a discretionary action. This follows a report alleging $420 million in compliance lapses due to delayed or absent freezes, including $230 million in USDC during the Drift incident. Circle argues that the mismatch between blockchain speed and legal processes creates structural gaps exploited by bad actors. The company calls for updated legal frameworks, such as the GENIUS and CLARITY Acts, to enable faster intervention while preserving due process and property rights.

ambcrypto04/10 15:47

Circle defends USDC freeze policy after Drift exploit, calls for faster legal frameworks

ambcrypto04/10 15:47

All about Solana’s liquidity situation after recent exploits – Where is the capital going?

Despite recent exploits, Solana's liquidity is showing resilience through internal capital rotation rather than mass outflows. SOL-denominated TVL has reached an all-time high of over 80 million SOL, and DEX volume hit $95 billion in February. While overall TVL declined to $5.55 billion after a $285 million hack, the net loss was only 8%, indicating funds are moving within the ecosystem to venues like Kamino, Raydium, and Jupiter rather than leaving the chain. This shift is reshaping DEX competition, with Jupiter's aggregator dominance slipping to 82% as alternatives like Titan gain traction. The internal flow and competitive routing help Solana absorb shocks, demonstrating a maturing structure where capital movement efficiency underpins stability.

ambcrypto04/07 07:11

All about Solana’s liquidity situation after recent exploits – Where is the capital going?

ambcrypto04/07 07:11

Solana Price Stays Under Pressure As 1.4M Tokens Flow To Exchanges

The Solana price is facing significant downward pressure, exacerbated by a major DeFi exploit that resulted in over $270 million in outflows from the ecosystem. On-chain data reveals a bearish signal as 1.4 million SOL tokens, valued at approximately $110 million, were transferred to centralized exchanges within a 72-hour period. This substantial increase in exchange inflows is often a precursor to heightened selling pressure, as investors move assets to exchanges to offload them. Consequently, the Solana price, which had already dropped below the key $80 support level after a local high of $85, remains under strain. At the time of writing, SOL is trading around $80.80, showing little change over 24 hours but down more than 3% over the past week.

bitcoinist04/06 11:32

Solana Price Stays Under Pressure As 1.4M Tokens Flow To Exchanges

bitcoinist04/06 11:32

‘Beyond code errors’ – How Drift Protocol’s $285mln drain shifts DeFi security bar

The Drift Protocol exploit, resulting in a $285 million loss, marks a significant shift in DeFi security threats, moving beyond simple code errors to sophisticated attacks on governance and operational control layers. The attacker used pre-signed transactions and manipulated a multi-signature mechanism to gain admin access rapidly. This incident underscores that security now depends more on protecting protocol operations and user assets than solely fixing smart contract bugs. Drift’s response demonstrated the critical role of fast crisis management—halting deposits and withdrawals quickly, coordinating with security partners, and providing transparency—which helped contain cross-protocol risks and maintain market confidence. The event reflects a broader trend in DeFi, where attackers increasingly target access and control mechanisms. This has elevated the importance of operational security, prompting protocols to compete not only on yield but also on their ability to manage risk, protect capital, and respond effectively during crises. Industry data shows a growing focus on security investments, such as signer rotation and emergency controls, as key factors in building resilience and trust.

ambcrypto04/06 05:03

‘Beyond code errors’ – How Drift Protocol’s $285mln drain shifts DeFi security bar

ambcrypto04/06 05:03

Bitcoin, Ethereum trend amid ‘Extreme Fear’ – But THIS signal warns of caution

The global crypto market shows modest improvement after volatility from U.S.-Iran tensions. Santiment highlights trending coins, with Ethereum and Bitcoin leading due to quantum-computing risk discussions, institutional interest like Charles Schwab offering spot trading, and geopolitical impacts. However, active addresses for BTC, ETH, and Chainlink (trending from large on-chain moves and unlocks) show declining retail activity, indicating investor caution. Solana gained attention negatively from a $270M+ exploit, while memecoin Pippin trended on hype, not fundamentals. USDC stablecoin trends despite hack-related transfers, still outpacing USDT in volume. Overall, market signals are conflicting, with Coinbase warning of risks ahead of Trump’s Iran deal deadline.

ambcrypto04/05 19:02

Bitcoin, Ethereum trend amid ‘Extreme Fear’ – But THIS signal warns of caution

ambcrypto04/05 19:02

活动图片

Hot Categoriesright-arrow

Hot Tagsright-arrow

Market Analysisright-arrow