News
The $rsETH Contagion: WTF Happened?
DeFi lost ~$13.5B in TVL in just 48 hours. Many even feared DeFi was dead.
It wasn’t due to a quantum attack or some govt crackdown. It was cuz a single token, $rsETH, was hacked. How did that happen?
What is $rsETH?
KelpDAO is a liquid restaking protocol on top of EigenLayer.
You deposit ETH. Kelp stakes it first, then restakes it through EigenLayer. So you’ll earn two layers of yield: ETH staking yield & EigenLayer restaking yield.
$rsETH is the liquid token for that strategy.
It’s a big protocol. By April 2026, it had $1B+ TVL. It was also whitelisted as collateral on Aave, SparkLend, Fluid, Compound, Euler, and Upshift.
$rsETH was issued on Ethereum. But it was bridged to 20+ chains with LayerZero. Here’s how it worked:
- User clicks the button to bridge rsETH from Ethereum to Arbitrum.
- Behind the scenes, $rsETH on Ethereum will be locked up in a smart contract, and equivalent rsETH will be minted on Arbitrum.
- So, the rsETH on L2s like Arbitrum are technically backed by rsETH on Ethereum.
Sounds great.
But who “locked and minted” the rsETH? How are messages sent across blockchains?
LayerZero uses something called Decentralized Verifier Networks (DVNs) for that role. And that was the weakness the hackers used.
Hack Explained.
Projects using LayerZero have different options for DVNs with various levels of security.
But including KelpDAO, 47% of L0 contracts use 1-of-1 DVN security floor. It meant that if just one DVN was compromised, the entire bridging system would be at risk. And that was exactly what happened in the case of $rsETH.
The hackers compromised the DVN run by LayerZero and were able to influence the unlocking of rsETH.
Remember how rsETH on L2s were backed by rsETH on Ethereum? Well, the hacker forged a message that led the bridge on Ethereum to release 116,500 rsETH (~$292M, ~18% of supply) that was supposed to back rsETH on L2s.
You can read the technical details here. TLDR: rsETH on L2s became unbacked.
Both KelpDAO & LayerZero blamed each other. But the biggest casualty was Aave.
The Aave Fallout
The hacker was sitting on 116.5k rsETH, but there wasn’t enough liquidity to dump it. So deposited the stolen rsETH as collateral on lending protocols and borrowed ETH/WETH against it.
The included lending protocols were Euler, Compound v3, and Aave on Ethereum and Arbitrum. Most of the rsETH were deposited on Aave.
When the issue became known, Aave froze the rsETH and wrsETH markets across all deployments, but it was already too late.
Result? ~$177M+ bad debt on Aave. ~$236M in bad debt across the protocols.
(To clarify, Aave & lending protocols aren’t “innocent” victims. It was their job to ensure that only safe collaterals were listed on the platform. And listing an asset with a 1-of-1 DVN security floor is on them.)
Now lenders who supplied WETH to Aave were in trouble. The hacker isn’t gonna pay it back to Aave, and Aave doesn’t have the funds to make all WETH suppliers whole. So aWETH (the receipt token for lending WETH on Aave) depegged.
The issue wasn’t contained there.
aWETH holders used it as collateral to max borrow stablecoins. Now the stablecoin market has become illiquid as well.
That stablecoin illiquidity had further effects. Ethena lost ~$2 billion of its TVL.
- Aave hosted a large chunk of sUSDe leverage yield farming (supply sUSDe → borrow USDC → Loop).
- When demand for stables increased massively, interest payment on USDC increased, and the looping strategy started losing money.
Strategies on Aave using ETH LSTs were used by major protocols in DeFi: Lido, EtherFi, and IPOR are examples. All of these strategies started bleeding as well. Aave did change its parameters to maintain stability.
TLDR; the Aave bad debt had a widespread impact on the industry.
You can monitor the situation of whales stuck in Aave here.
The situation could’ve been much worse if the ETH price had fallen 5-10%. It’d have triggered liquidations that Aave couldn’t process. Thankfully, it didn’t happen.
After the hack happened, we released a detailed market pulse in TDE Pro. It covered exactly what to do depending on your situation. It highlighted Fluid’s aWETH Redemption Protocol, which allowed users to swap aWETH for wstETH or weETH.
But covering all of that is beyond the scope of this article. In the next article, I’ll cover how DeFi responded and what this means for the future of DeFi.
TDE Product
TDE Pro: Navigate The Hardest Part of the Cycle
Half of your friends have already stopped checking their portfolio. The other half are convinced crypto is dead.
Every bear market feels terminal when you’re inside it. 2018 did. 2022 did. This one does too.
But the ones who get paid on the other side are the ones still paying attention right now.
Here’s the problem: paying attention has never been harder than it is right now.
Every take on your timeline contradicts the last one. The influencers you relied on in the bull run have either gone completely quiet or started pumping out AI-slop threads they didn’t even write. The group chats that used to share alpha are sharing cope. You’ve stopped trusting your own judgment, and you know it.
This is what bear markets actually do.
They don’t just drain your portfolio. They drain your conviction.
The DeFi Edge Pro was built for this exact part of the cycle.
Ten minutes a day is enough. No 40-tab Twitter sessions. No chasing pumps. No wondering which newsletter is actually worth reading. You get a system for staying oriented when everyone else is panicking. Built by people who’ve been here through 2018, 2022, and everything in between.
The people who quit at the bottom always regret it. The ones who lock in quietly become the ones everyone else asks for alpha in 18 months.
If you’ve read this far, you already know which group you want to be in.
Let me show you what we’ve built for people exactly like you.
Analysis
DeFi United: How Did We Respond? And What Does it Mean for the Future?
Everyone in DeFi was scrambling to address the situation.
Most projects using LayerZero immediately paused their bridge operations. Protocols with direct exposure to rsETH or indirect exposure via Aave also froze relevant parts.
All of that was expected outcomes. And when things started to clear, like LayerZero clarifying that their systems were secure, they resumed the operations.
But some notable moves forever changed DeFi.
#1. Arbitrum Froze Hacker Funds
The hacker was holding ~30k $ETH (worth ~$71M) on Arbitrum.
Arbitrum Security Council froze those funds. Now, Arbitrum Governance can decide what to do with those funds. It’ll probably go to filling the whole created by the hack.
The community largely celebrated this action. Nobody wanted the money going to hackers.
But this action broke the “decentralization” claim of L2s. And some were worried about it.
If the Security Council, a group of 12 individuals elected by the Arbitrum DAO, can suddenly freeze someone’s funds, then is the chain decentralized? What’s stopping them from freezing user funds if the IRS sends a notice to Arbitrum? Will that power be used by the government to hunt down dissidents? And so on.
So for many people, this action felt antithetical to crypto’s principles.
Most people still thought freezing was the right thing to do. For me, here are two takeaways from the episode.
- Camila Russo said L2s and the security council will have to create an explicit constitution on where they’ll interfere and where they won’t.
- Gabriel Shapiro said that now L2s will have to start taking responsibility for events like these, or completely remove this power by going to stage 2.
(Interesting fact: ThorChain made $910k in fees when the hacker swapped through its protocol.)
#2. The Lending Sector
There are two major types of DeFi lending protocols: monolithic and modular.
Morpho is the best example of modular lending. They had faced a similar issue with USR & Reserv. But it didn’t create a contagion as Aave did. Why? Because modular platforms contain the losses at the market/vault level.
But the pool model of the monolithic projects like Aave socializes risk by default. They are only as strong as the weakest collateral. rsETH was the weakest; everyone’s affected
There is a third category that includes projects like Maple and USDai. They’re ultimately protected by the legal system when borrowers default.
This event probably starts the decline of monolithic lending models. Capital will shift towards more modular options.
One protocol that actually grew in this episode was SparkLend. Its TVL climbed from ~$1.8B to $3.5B in just four days.
#3. DeFi United
The biggest issue in DeFi right now is the unbacked 112,204 rsETH.
Due to contagion, this was a collective issue of DeFi. And now, DeFi has come together to fill the gap. Aave had started a relief initiative called “DeFi United”.
- Stani, the Aave founder, committed 5000 ETH to it.
- Emilio and Ernesto committed 500 and 100 ETH, respectively.
- Lido posted a proposal to commit up to 2,500 staked Ethereum.
- Mantle is discussing providing a 30k ETH loan to Aave.
- Others like Golem, Frax, EtherFi, and Ethena have also come forward.
If more protocols and projects come forward, we might be able to fix the issue. If Aave promises to repay the contributors with future revenue, there’s a high probability that we’ll be able to fill the hole.
This collective action was very nice to see during the darkest hour of DeFi.
🚀 DeFi Catalysts
MegaETH has hit a KPI required to launch its token, $MEGA. They’ll launch their token in seven days.
Lighter has released a skill that gives AI agents the ability to trade on their platform. It’s compatible with all Agent Skills-compatible frameworks.
USD.ai launched its governance token, $CHIP. Despite current market conditions and many airdrop recipients, it still has >$600M in FDV.
Telegram Wallet launched a $500K Rewards Program to incentivize user activity. It’s a points-based loyalty program built into Wallet.
Justin Sun filed a lawsuit in California federal court against World Liberty Financial for violating his rights over $WLFI tokens.
Polymarket and Kalshi announced that they’ll be launching Perps markets on their platforms. They’re not live yet, but you can sign up to get early access.
Lana AI is in open beta. It’s a new AI-powered Solana block explorer from Mert Mumtaz. You can explore onchain interactively.
🪂 Airdrop Alpha
Billions Network ($BILL) Human + AI identity/verification network. Season 1 Power Points earners can now register to lock rewards.
Dango is a high-performance L1 CLOB superapp for spot, perps, derivatives, and RWAs with unified margin. They’ve allocated 50% of the supply to airdrop.
📰 Industry News
Tempo introduced Tempo Zones that enable private txns. It’s become a bit controversial due to the misleading use of the term “privacy”.
Rhea Finance was exploited for $7.6M. Tether froze $3.29M of stolen USDT. This contrasts with the USDC policy of not freezing unless regulators ask.
Tether froze $344 Million in USD₮ in Coordination with OFAC and U.S. Law Enforcement across two addresses.
Circle introduced the USDC Bridge. It’s a direct way to move USDC cross-chain. It’s built and operated by Circle as well.
Strategy is proposing to pay semi-monthly dividends on $STRC, instead of monthly. There’ll be no change in annual dividend obligations or dividend rate.
Base announced the first network upgrade after it moved away from OP Stack to its own Base Stack. The upgrade is called Base Azul.
🐦⬛ X Hits
- Report on Jupiter’s moat.
- What’s left to do in crypto?
- Aave: cracks in the monolithic thesis.
- An Etherealize report valuing $ETH at $250k.
- ACE: the latest innovation explained.
😂 Meme
Until next time,
Edgy
Today’s email was written by Edgy and Yayya.
DISCLAIMER: I’m NOT a financial advisor. This content is for education and information purposes only. Crypto and DeFi are risky and speculative. Please do your research before investing.
|
|
|
Be Early to the Next Opportunities
TDE Pro gives you direct access to our research, our portfolios, and the gems we’re betting on.
It’s your unfair advantage to move before the crowds.
|
Whenever you’re ready, here’s how we can help you:
- ⚙️ The DeFi Edge PRO – Designed for busy people who want to stay ahead of the curve. Leverage our research to save you hours each week, and to see what we’re personally investing in. Join today.
- 🚀 The DeFi Edge Ventures – We identify, invest, and help amplify DeFi Protocols that positively impact the Crypto space.
You’re receiving this email because you signed up for my newsletter. You can update your Preferences or Unsubscribe here.
600 1st Ave, Ste 330 PMB 92768, Seattle, WA 98104-2246
