Incident Report: Llamarisk, Aave Service Providers Detail Kelp rsETH Hack Across Ethereum and Arbitrum Markets

Key Takeaways:

• According to Llamarisk, an attacker exploited Kelp’s Layerzero V2 span connected April 18, 2026, minting 116,500 rsETH without immoderate corresponding burn.
• Llamarisk estimates atrocious indebtedness betwixt $123.7M and $230.1M crossed 7 affected markets, depending connected however Kelp socializes losses.
• The Aave DAO treasury holds $181M arsenic of April 20, 2026, and work providers are already securing indicative betterment commitments from ecosystem participants.

Llamarisk Details rsETH Exploit Scenarios After Kelp OFT Adapter Drained

The analysis published by hazard absorption institution Llamarisk and Aave work supplier co-authors explained that the attack occurred astatine 17:35 UTC successful Ethereum artifact 24,908,285. The Unichain-to-Ethereum way was configured arsenic a 1-of-1 DVN path, meaning a azygous verifier could attest an inbound packet without immoderate corresponding outbound action, according to the report.

Llamarisk authors said the attacker forged a packet that was verified, committed, and delivered connected Ethereum, releasing 116,500 rsETH from the adapter, the Aave study notes. The adapter equilibrium fell from 116,723 rsETH to 223 rsETH successful a azygous block. The attacker fanned the stolen rsETH from 1 intake wallet crossed 7 subdivision addresses. Of the 116,500 rsETH received, 89,567 were deposited into Aave V3 markets connected Ethereum and Arbitrum arsenic collateral.

Those positions were utilized to get astir 82,650 WETH and 821 wstETH, with wellness factors settling betwixt 1.01 and 1.03. All 7 attacker addresses stay progressive connected Aave astatine the clip of publication.

Aave work providers co-authored Llamarisk’s afloat incidental study and confirmed that Aave’s ain smart contracts were not compromised. All protocol logic, including supply, repayment, and liquidation mechanics, continued to relation arsenic designed passim the event.

The Protocol Guardian began freezing each rsETH and wrsETH reserves crossed each Aave V3 deployments astatine astir 19:00 UTC connected April 18. The enactment acceptable LTV to zero and disabled caller proviso and borrowing portion leaving existing positions eligible for repayment and liquidation. Eleven markets crossed Ethereum, Arbitrum, Avalanche, Base, Ink, Linea, Mantle, MegaETH, Plasma, and Zksync were affected, according to the Aave forum analysis.

The study says the Risk Steward adjusted WETH involvement complaint models connected Arbitrum, Base, Mantle, and Linea astatine astir 14:30 UTC connected April 19, reducing Slope 2 to 1.50 percent and cutting the get complaint astatine 100 percent utilization from betwixt 8.5 and 10.5 percent down to 3.0 percent APR. A corresponding accommodation was applied to Core astatine astir 05:00 UTC connected April 20, with Slope 1 acceptable to 2 percent, Slope 2 to 3 percent, and optimal utilization acceptable to 94 percent.

The Protocol Guardian besides froze WETH connected Core, Prime, Arbitrum, Base, Mantle, and Linea astatine astir 02:00 UTC connected April 20 to forestall caller borrowing and incorporate imaginable accent from spreading to stablecoin reserves.

The 2 Scenarios

The 2 scenarios modeled by Llamarisk’s investigation bespeak however Kelp’s nonaccomplishment allocation determination volition find the protocol’s last exposure. Scenario 1 assumes azygous socialization of the 112,204 unbacked rsETH crossed the full rsETH supply, producing a 15.12 percent depeg and an estimated $123.7 cardinal successful atrocious debt, with Ethereum Core absorbing $91.8 cardinal successful implicit presumption and Mantle facing a 9.54 percent WETH reserve shortfall.

Scenario 2 treats the nonaccomplishment arsenic isolated to L2 rsETH only, applying a 73.54 percent haircut to collateral connected distant chains portion leaving Ethereum mainnet rsETH afloat intact, producing an estimated $230.1 cardinal successful atrocious indebtedness concentrated connected Mantle astatine a 71.45 percent WETH shortfall and Arbitrum astatine 26.67 percent.

The existent adapter equilibrium stands astatine 40,373 rsETH, the lone confirmed backing for each remote-chain rsETH crossed each L2 path, against full distant claims of 152,577 rsETH. Kelp has not publically confirmed however the recovered funds volition beryllium allocated.

As of April 20, 2026, the study said that the Aave DAO treasury holds $181 cardinal successful assets, including $62 cardinal successful Ethereum-correlated holdings, $54 cardinal successful AAVE, and $52 cardinal successful stablecoins. The DAO generated $145 cardinal successful gross during 2025 and $38 cardinal year-to-date successful 2026. Llamarisk confirmed that respective indicative commitments from ecosystem participants are already successful spot to code imaginable bad-debt scenarios.

WETH reserves connected Ethereum, Arbitrum, Base, Linea, and Mantle are astatine 100 percent utilization, with idle balances beneath $20 connected each chain. At afloat utilization, liquidators person aWETH alternatively than underlying WETH, which slows liquidation throughput.

Llamarisk’s study flagged Base and Arbitrum arsenic the slightest buffered markets, with archetypal liquidations triggered astatine WETH terms drops of 0.77 percent and 1.77 percent, respectively, owed to positions moving astatine wellness factors astir 1.03.

Llamarisk recommended an contiguous intermission of the WETH Umbrella staking module nether Scenario 1. As of the report’s publication, 18,922 of 23,507 staked aWETH had entered the unstaking cooldown.

A intermission would artifact deposits, withdrawals, transfers, and slashing portion keeping rewards organisation active. The remaining 4 rsETH-listed markets, Ethereum Lido, MegaETH, Plasma, and Zksync, transportation trivial balances and nary atrocious debt. Twelve further Aave V3 markets bash not database rsETH and are unaffected.