TRUE DEFI-DETECTIVE?: At 5:35 PM UTC on April 18, an attacker sent a specially crafted message to Kelp $DAO's LayerZero-based cross-chain bridge. The bridge accepted the message as legitimate and transferred 116,500 rsETH - worth approximately $293 million and roughly 18% of the total circulating token supply to a wallet that had been funded via Tornado Cash ten hours earlier. The crucial point: No $ETH changed hands on the other side. The rsETH were essentially created out of thin air. The attacker didn't attempt to sell them. Instead, they deposited them as collateral in Aave V3, borrowed real Wrapped Ether to do so, and then repeated the process in Aave V4.