Aave Faces $200 Million Bad Debt Following rsETH Bridge Exploit

A recent exploit involving the rsETH bridge has resulted in approximately $200 million in bad debt for Aave. Attackers managed to forge around 116,500 rsETH and used it as collateral for borrowing. According to NS3.AI, Chainalysis has preliminarily linked the April 18 attack to the Lazarus group. Aave's incident report revealed that a forged bridge message was accepted due to poisoned nodes providing false data into a 1-of-1 DVN setup. DefiLlama reported that losses from exploits in April amounted to over $635 million across 28 incidents, with cumulative hack losses reaching $16.5 billion. In response, LayerZero has banned 1-of-1 verifier configurations across its protocol.