Key facts
- Aave is overhauling asset listing standards and risk management after a $292 million exploit.
- The exploit involved a forged cross-chain message on LayerZero's V2 bridge affecting rsETH.
- An attacker used unbacked rsETH as collateral on Aave V3 to borrow other assets.
- A coalition of DeFi protocols contributed $300 million to restore backing for exploited assets.
- Arbitrum froze 30,766 ETH linked to the attacker.
On April 18, 2024, Aave experienced a significant exploit where a forged cross-chain message allowed an attacker to steal $292 million worth of rsETH. This event highlighted vulnerabilities in cross-chain communication and the potential for rapid contagion in the DeFi ecosystem, leading Aave to re-evaluate its risk management and listing standards.