kelp

今年DeFi圈最大的一单被黑，发生在4月18日周六，Kelp DAO的跨链桥在46分钟里被搬走116500枚rsETH，折合2.92亿美元。追回更新和一纸诉状把经过补齐了。
rsETH是Kelp发的流动性再质押凭证，你存ETH进去，它拿去EigenLayer赚收益，再给你一张能流通抵押借钱的rsETH收据。桥凭一边的销毁证明，在另一边放行等量代币。当晚有人凭空铸出116500枚rsETH，背后没有任何ETH存入。
黑客分两步走。按诉状的说法，3月6日，他先给一名LayerZero开发人员电脑装木马，拿到节点权限。4月18日，被控节点向验证器喂假数据，验证器放行了一条伪造的跨链消息，桥直接放行。前提是，Kelp这座桥只配了一个验证者，还是LayerZero自己跑的，消息真假全凭这一家说了算。
钱到手后，黑客没急着跑。他把一部分rsETH抵押进Aave借WETH，换走约10.6万枚ETH，约2.5亿美元。Kelp在46分钟后冻结合约，拦下第二笔4万枚铸造。9个协议同一天冻结rsETH市场，Arbitrum冻住攻击者手里3.0766万枚ETH，还冻着。Chainalysis把攻击归因于朝鲜Lazarus。
到11月7日，Kelp追回4.3万枚ETH，加上Arbitrum冻住的3.0766万枚，一共约7.37万枚，原缺口16.32万枚，还剩约8.95万枚没补上。缺口比铸出的11.65万枚多，是因为黑客还拿无 backing 的rsETH抵押借走WETH，借走的钱也要算进窟窿里。Aave、Mantle、Lido等协议凑了DeFi United，承诺4.35万枚ETH。9月24日，Kelp开发公司Evercrest在加拿大BC省起诉LayerZero和它的CEO，理由是对方2024年书面认可过单验证者配置，还让照抄另一座桥。LayerZero称指控毫无根据，官司还没判。
这事跟拿着rsETH的散户直接相关。生息凭证不是存款，价值挂在桥和验证方式上，桥一出事，凭证先脱锚，抵押借钱的仓位跟着被清算。名气大也不等于验证做得严，Kelp的链上记录显示，这座桥本来配过两个验证者，后来改成一个，没人喊停。被黑也不等于钱全没了，追回真实存在，但要等几个月，缺口至今没补满。
我的观点就一句，桥的安全不看名头看验证者个数，一个验证者就是没验证。
你手里有没有生息凭证，查过它背后那座桥的验证方式吗？
#Kelp #LayerZero #跨链桥 #安全复盘 #rsETH
—— web3韭菜小凯
本文仅为个人观点分享，不构成任何投资建议，数据来源 Unchained、The Block、Bitquery、DeFi United 追踪页与公开报道，金额为事件发生时估值，行情随时变化，请自行判断风险。

Wu Blockchain reports that Kelp DAO has suffered a massive cross-chain exploit that drained approximately 116,500 rsETH, valued at nearly $292 million. The incident raises fresh concerns about the protocol’s security, coming less than a year after a previous disruption tied to a smart contract bug
Kelp DAO Response Prevents Additional Exploit Attempts
According to blockchain data, the attack on the Kelp DAO exploited a weakness in cross-chain communication, specifically targeting the bridge mechanism used to transfer assets across networks. The exploit was executed via a call to the “Iz Receive” function on LayerZero’s EndpointV2, which ultimately triggered the release of funds to an attacker-controlled wallet.
On-chain sleuth ZachXBT was among the first to uncover the breach, estimating losses exceeding $280 million across Ethereum and Arbitrum. The blockchain investigator also noted that the attack addresses had been initially funded via Tornado Cash, indicating a deliberate effort to conceal the funding sources for the highly coordinated attack.
#kelp #KelpDAOFacesAttack
In response to this attack, Kelp DAO implemented an immediate halt to all rsETH contracts across its mainnet and connected L2 networks. The protocol also froze activity across its core contracts and systems that cover deposits, withdrawals, and oracle functions. According to Kelp DAO, an ongoing investigation is underway with LayerZero and Unichain.
Notably, the attacker attempted two additional transactions to drain another 40,000 rsETH, worth close to $100 million. However, Kelp DAO’s swift measures ensured both attempts failed, preventing losses from rising to $391 million.
Aave Freezes rsETH Contracts
In other news, the fallout has quickly spread beyond Kelp DAO, with lending protocols feeling immediate pressure. Aave, one of the largest DeFi lending platforms, responded by freezing rsETH markets across its V3 and V4 deployments.
However, Aave has clarified that its own smart contracts were not exploited, and the measure is purely precautionary to limit further debt exposure to rsETH as they assess the situation. Aave management is also committed to evaluating potential mitigation strategies if any bad debt emerges from the exploits.
rsETH itself is a liquid restaking token designed to represent staked ETH while enabling users to earn additional yield through restaking strategies. It plays a key role in cross-chain DeFi, allowing capital to move seamlessly across multiple networks, including Arbitrum, Base, and Scroll. The scale of the exploit is particularly damaging as the stolen funds represent roughly 18% of rsETH’s total circulating supply, representing a significant hit to both liquidity and user confidence.
$ETH