Hey, it’s Marc,

We’ve watched a lot of DeFi blowups. This one’s different. Nobody hacked Aave last weekend. $196M walked out the door anyway. The attacker forged a message on a bridge next door, minted $292M of fake rsETH, and posted it to Aave as collateral. Aave’s code worked exactly as written. That’s the problem. [ANNOUNCEMENT]

The Signal: TradFi separates the issuer, the custodian, and the lender by law and regulation, so fraud at one can't poison the other two. DeFi fused them into a single contract call, and called the result a feature. The code worked exactly as written, but still cost depositors money. Every LP on every lending protocol just learned they were implicitly underwriting bridge security for every collateral asset the protocol lists.

👉PRO: Download the PDF below

What happened

Imagine you run a bank. Someone walks in with a stock certificate and asks to borrow against it. You don’t just look at the certificate. You call the company that keeps the official record of who owns what shares. They confirm the certificate is real and the person holding it actually owns it. Then you make the loan.

Aave skipped that step. Not because Aave is stupid. Because the system Aave plugs into doesn’t have anyone to call.

Someone drained $292M rsETH from Kelp through a smart contract exploit. Kelp’s bridge on LayerZero Labs had one validator signing off on everything. One forged signature and the vault was empty.