DeFi Hack: Aave and LayerZero Hit by Sophisticated DPRK Attack

DeFi Crash: The rsETH Contagion

Confidence in the Decentralized Finance (DeFi) ecosystem has plummeted to an all-time low following a cascading series of security failures. What began as a targeted exploit on Kelp DAO’s rsETH (Liquid Restaked ETH) has rippled through the industry’s most trusted protocols, most notably Aave, the world’s largest lending market.

The incident has reignited a fierce debate over the risks of “DeFi composability”—the practice of layering different protocols on top of one another. Critics argue that a simple Ethereum deposit should not be vulnerable to the failure of a complex, cross-chain restaking bridge.

Aave and LayerZero: What Happened?

The crisis was triggered by a sophisticated exploit targeting the bridge infrastructure of rsETH. According to forensic reports, the attacker—widely identified as the North Korean state-sponsored Lazarus Group (DPRK)—executed a multi-stage attack on LayerZero’s Decentralized Verifier Network (DVN).

The Anatomy of the Exploit

Contrary to initial speculation that the DVN itself was compromised, the attackers targeted the RPC (Remote Procedure Call) nodes that the DVN relied on for data.

1. The Lure: Attackers identified two specific RPCs used by the DVN.
2. The Sabotage: A Distributed Denial of Service (DDoS) attack was launched against the DVN’s primary, healthy RPCs.
3. The Deception: This forced the system to fail over to the two compromised RPCs. These malicious nodes served accurate data to the public but fed fraudulent state information to the DVN, bypassing traditional security safeguards.

Impact on Aave: Frozen Markets and Bad Debt

The exploit allowed the attacker to mint fraudulent rsETH and deposit it into Aave to drain approximately $300 million in ETH. This sudden exodus of liquidity caused a “Whale Panic,” with figures like Justin Sun reportedly withdrawing over $150 million in a single transaction.

Current Protocol Status

In an official statement, Aave confirmed that rsETH is now frozen across Aave V3 and V4. Additionally, WETH reserves remain frozen on several networks, including Ethereum mainnet, Arbitrum, Base, Mantle, and Linea, to prevent further contagion.

• Utilization Crisis: Lending rates for ETH spiked to 10-15% as utilization hit 100%.
• Liquidity Lock: Many lenders are currently unable to withdraw their assets because all available ETH in the pool is technically “borrowed.”

Is the Debt Recoverable?

Aave’s official analysis suggests that rsETH on the Ethereum mainnet remains fully backed, and the exposure has been capped. However, the market remains skeptical. The “bad debt” looming over the protocol remains a primary concern for crypto news analysts. Until it is clear who will bear the brunt of the $300 million hole, trust in the “money lego” architecture of DeFi will remain suppressed.

For those looking to secure their remaining assets, diversifying into hardware wallets or reviewing top exchange comparisons for safer exit ramps has become a priority for many retail users.

Return to Pristine Collateral

The fallout from this incident suggests a shift in investor sentiment. There is an increasing demand for a “return to basics”—using pristine collateral like Bitcoin or native ETH rather than complex derivative products. While LayerZero has restored its DVN services, the industry now faces weeks of introspection regarding RPC security and the dangers of single-point-of-failure configurations.