DeFi Hack: Aave and LayerZero Hit by Sophisticated DPRK Attack

DeFi Crash: The rsETH Contagion

Confidence in the Decentralized Finance (DeFi) ecosystem has plummeted to an all-time low following a cascading series of security failures. What began as a targeted exploit on Kelp DAO’s rsETH (Liquid Restaked ETH) has rippled through the industry’s most trusted protocols, most notably Aave, the world’s largest lending market.

The incident has reignited a fierce debate over the risks of "DeFi composability"—the practice of layering different protocols on top of one another. Critics argue that a simple Ethereum deposit should not be vulnerable to the failure of a complex, cross-chain restaking bridge.

Aave and LayerZero: What Happened?

The crisis was triggered by a sophisticated exploit targeting the bridge infrastructure of rsETH. According to forensic reports, the attacker—widely identified as the North Korean state-sponsored Lazarus Group (DPRK)—executed a multi-stage attack on LayerZero’s Decentralized Verifier Network (DVN).

The Anatomy of the Exploit

Contrary to initial speculation that the DVN itself was compromised, the attackers targeted the RPC (Remote P...