Curve founder urges unified DeFi security standards after rsETH/Aave shock

Curve founder Michael Egorov says repeated “avoidable” DeFi hacks persist even after audits, arguing the root cause is centralized single points of failure. He points to the KelpDAO rsETH exploit as the latest proof. An attacker drained about 116,500 rsETH (≈$292m at the time) by forging a cross-chain message, then routed the stolen rsETH into Aave as collateral. After the forged message cleared, the attacker used rsETH on Aave V3 to borrow large amounts of wrapped ether, triggering more than $10bn in withdrawals as users rushed to exit. Aave later froze rsETH markets on V3 and V4 to contain risk. LayerZero said the breach was enabled because Kelp ran a single 1-of-1 DVN verifier with no backup, creating a “chokepoint” risk that can hide inside bridges, oracles, governance multisigs, and admin keys. Industry estimates put broader Kelp-related losses near $293m, with nine connected protocols halting or restricting rsETH activity; Arbitrum’s security council later seized about 30,766 ETH tied to the attacker. Egorov’s proposal is to establish shared, concrete best practices under new DeFi security standards—cross-chain verifiers, rate limits, multisig policies, and kill switches—coordinated by major ecosystem bodies. He urges the Ethereum Foundation and Solana Foundation to convene a common rulebook (not formal regulation). For traders, DeFi security standards are becoming a market risk factor: collateral de-risking and liquidity shocks from single-point failures can quickly spread across composable lending and bridging ecosystems, pressuring ETH-linked liquidity in the short term.