The release of the post-mortem came more than a month after an attacker exploited a third-party bridge operated by Kelp and Layerzero. By fabricating cross-chain messages, the hacker minted 116,500 counterfeit rsETH tokens and deposited them into Aave’s V3 platform as collateral.
To plug the hole, Aave Labs helped mobilize an emergency coalition of major industry players, including Lido, Ether.fi, Ethena and Compound. Together, the group structured a $300 million recovery fund. This capital injection effectively backstopped the compromised rsETH assets, guaranteeing that every dollar of user deposits remained fully collateralized by authentic reserves.
Unfreezing the capitalTo prevent future attackers from converting exploited tokens into liquid protocol assets, Aave developers executed 295 individual parameter updates, heavily slashing borrowing and supply caps across 168 separate asset pools.
