Risk Management Update: rsETH Exploit Incident Response

Risk Management Update: rsETH Exploit Incident Response

Background

On April 18, 2026, a security incident affecting rsETH was identified. The incident involved the unauthorized release of approximately 116,500 rsETH from KelpDAO’s bridging adapter following a forged cross-chain message. LayerZero published their incident statement on April 19, attributing the attack to the Lazarus Group and stating that no other cross-chain asset or application was affected. KelpDAO published additional context on April 20, disputing part of LayerZero’s characterization of the DVN configuration involved. Given rsETH’s presence as collateral across several lending and liquidity venues integrated with Lazy Summer fleets, BA Labs began assessing contagion risk across all active arks and initiated protective measures.

Direct rsETH exposure within Lazy Summer at the time of discovery was approximately 4.22% on Base and 1.7% on Mainnet. In addition, rsETH was identified as collateral in several Morpho vaults integrated with active arks, creating indirect exposure. BA Labs paused keepers immediately to prevent any additional allocation to affected arks during the assessment and transaction preparation period.

Risk Rationale

L2 deployments were treated as the higher priority for intervention for two reasons. First, Aave’s Umbrella safety module is not deployed on L2s. Second, rsETH holders on L2s face elevated resolution uncertainty, given that final loss allocation between Mainnet and external chains remains unresolved as of this writing.

Fluid markets warranted attention independently, as BA Labs has observed recurring instances where keepers are unable to withdraw from Fluid positions despite caps being set to zero, making early intervention critical regardless of cap status.

Actions Taken

April 18 to 19, 2026 (Batches 1 and 2)

Aave V3

Aave froze rsETH and wrsETH markets across all deployments where the asset is listed. As market stress developed, additional containment actions were taken on selected WETH markets. Caps were set to zero for:

  • Mainnet LR: WETH, USDC, USDT
  • Mainnet HR: WETH
  • Base LR: USDC, EURC, WETH
  • Arbitrum LR: USDC, USDT
  • Sonic LR: USDC.e

Spark

rsETH-related exposure was treated as requiring precautionary action. Caps were set to zero for:

  • Mainnet LR: USDC, USDT

Compound V3

Caps were set to zero for:

  • Mainnet LR: WETH
  • Mainnet HR: WETH

Fluid

rsETH was present as collateral across multiple Fluid markets. Combined with the recurring keeper withdrawal issue, BA Labs treated all active Fluid ETH markets as requiring immediate action. Caps were set to zero for:

  • Mainnet LR: WETH, USDC, USDT
  • Mainnet HR: WETH, USDC
  • FluidLite Mainnet HR: WETH
  • Base LR: WETH, USDC, EURC
  • Arbitrum LR: USDT

Morpho KPK markets

These Morpho vaults use syrupUSDC as underlying collateral, linking them to Maple Finance. While Maple has no known direct rsETH exposure, caps were set to zero as a precautionary measure given broader market stress. Caps were set to zero for:

  • Mainnet LR: morpho_kpk_usdc_prime, morphoV2_kpk_usdc_prime, morphoV2_kpk_weth_prime
  • Mainnet HR: morpho_kpk_weth_prime

Morpho yearn og, InfiniFi, and morpho_extrafi markets

These vaults had direct or indirect rsETH exposure across the HR and LR fleets. Caps were set to zero for:

  • morpho_y_og_weth (Mainnet HR)
  • morphoV2_yearn_og_usdc (Mainnet HR)
  • morpho_steakhouse_infinifi_usdc (Mainnet HR)
  • infiniFi siUSD (Mainnet HR)
  • morpho_extrafi_xlend_weth (Base LR)

April 20, 2026 (Batch 3: Origin OETH, Mainnet HR)

The allocation cap for Origin OETH was set to zero. In an active LST contagion environment where cross-chain loss allocation remains unresolved, products with third-party LST exposure may introduce tail risk that BA Labs does not consider appropriate for continued allocation under current conditions. This is a precautionary measure consistent with BA Labs’ incident response standards and will be reassessed once the rsETH situation is fully resolved.

Present Exposure

As of April 22, 2026, the only remaining rsETH-related exposure within Lazy Summer is isolated to the FluidLite WETH ark (Mainnet HR), where liquidity is actively unwinding. Following the actions described above, exposure within the HR ETH Mainnet fleet was reduced to approximately 0.05%, and has since decreased further to approximately 0.02% as the unwinding process progresses. At the protocol level, current exposure stands at approximately 0.007%. BA Labs expects this to decrease further as keepers are able to withdraw additional liquidity as it becomes available from the protocol.

Ongoing Monitoring

BA Labs is continuously monitoring all remaining active arks for contagion risk as the rsETH situation develops. Further cap adjustments will be made without delay if conditions warrant, and this post will be updated accordingly.

2 Likes

Thanks @BlockAnalitica for the thorough write-up and the quick action across the fleets.

One correction on Batch 3: the rationale cites “third-party LST exposure,” but OETH does not have any. OETH was simplified by governance in 2023 and is backed entirely by native ETH staked through OETH-operated DVT validators, with beacon chain balances verified on-chain via Merkle proofs rather than third-party oracles. No rsETH, stETH, rETH, or other LSTs are held as collateral. Redemption paths (async beacon chain withdrawals, Curve, vault, ARM) don’t route through any bridge or cross-chain message. OETH’s full architecture can be found here: Origin Ether (OETH) | Origin

OETH behavior during the incident window is also worth mentioning: OETH has held the tightest peg to ETH of any major LST or LRT currently tracked in the screenshot below. Participants positioned to rotate away from incident-adjacent products did not price OETH as one:

We support precautionary caps on assets actually in the affected category, and we understand category-level defaults during an active incident. For OETH, we’d ask the cap be reassessed on the product’s real risk surface. Happy to provide any verification BA Labs would find useful.

1 Like