Reopening controls for the affected rsETH bridge route

By October 29, 2026, the captured public analysis reported that LayerZero message nonce 308 had already caused the Ethereum-side bridge to release 116,500 rsETH without a corresponding Unichain transaction, while a second attempted release of 40,000 rsETH was stopped.

It further reported that the released rsETH entered Aave V3 and that 52,440 ETH was consolidated. Those reported events show an immediate containment need: the single-verifier route should not process further transfers while the authorization failure, affected accounts and proceeds are reconciled.

Although the underlying investigator or bridge-operator source is not attached, the evidence review found the shutdown and layered reopening controls supported by the packet.

KelpDAO rsETH bridge operators responsible for the affected Ethereum-side route tied to Unichain face the immediate task of keeping that route disabled, removing its single-verifier authorization path and proving replacement controls before reopening.

People and services attempting to transfer rsETH through that route cannot safely resume transfers until authorization and source-chain inclusion controls pass independent tests.

Aave V3 operators, liquidity providers and borrowers have exposure to the reported deposit of the released rsETH and to any resulting liquidation, lending-loss or recovery effects, which remain unreconciled.

Exchanges and custodians holding relevant transfer or recovery records may need to preserve those records. The captured analysis reports that the rsETH token contract itself was not compromised, so this decision does not claim that every rsETH holder, token deployment or route is compromised.

No affected software-version numbers are supplied; the defined scope is the affected route and its single-verifier configuration.

1. Supporting analysis: The captured public analysis relays an Exvul report that LayerZero message nonce 308 caused the Ethereum-side bridge to release 116,500 rsETH without a corresponding Unichain transaction, that one verifier authenticated the message and that a second attempted release of 40,000 rsETH was stopped. It also reports that the rsETH entered Aave V3 and 52,440 ETH was consolidated. This supports keeping the route disabled while authorization is reconciled.
2. Supporting control analysis: The evidence review found direct support in the packet for replacing the single-verifier path with independently operated multi-party verification, validating source-chain inclusion and adding caps, delays and anomaly-triggered circuit breakers before reopening.
3. Insufficient-evidence finding: The evidence review found that the packet supports preserving relevant records but does not specifically establish a bridge-level requirement to preserve message and relayer evidence.
4. Source-gap finding: The evidence review found no directly attached investigator report or bridge-operator confirmation for the core incident account. This does not contradict the shutdown decision, but it requires the 116,500 rsETH release, nonce 308 and single-verifier details to remain attributed as reported.

The decision scout connected the reported release through the single-verifier path to an immediate containment decision: disable the affected KelpDAO rsETH bridge route and require layered authorization before reopening.

The captured roundtable contribution supplied the reported on-chain details, including LayerZero message nonce 308, the release of 116,500 rsETH on Ethereum without a corresponding Unichain transaction, the stopped attempt involving 40,000 rsETH, the Aave V3 deposit and consolidation of 52,440 ETH.

The evidence review supported the shutdown, multi-party verification, source-chain inclusion checks, caps, delays and circuit breakers, but found two limits: the incident account lacks a directly attached investigator or bridge-operator source, and preservation of message and relayer evidence was more specific than the packet supported.

The boundary review resolved those limits by retaining attribution for the incident details and broadening preservation to relevant records.

Retrieval found no prior matching decision, and the arbiter selected a new operational decision because those wording and attribution gaps did not undermine the core shutdown and redesign position.