rsETH Security Incident Causes Significant ETH Market Impact
Severity: Medium (Score: 48.9)
Sources: Odaily.News, Bitget, www.odaily.news
Published: · Updated:
Keywords: analyst, rseth, aftermath, security, incident, continues, odaily
Severity indicators: conti
Summary
On May 18, 2026, on-chain analyst Tom Wan reported a significant decline in Ethereum (ETH) utilization following the rsETH LayerZero cross-chain bridge attack. The ETH utilization rate has fallen below 90%, with lending annual percentage yields (APY) dropping to 1.9%. The attack has resulted in a loss of approximately $1.2 billion in wstETH deposits and $1.76 billion in weETH deposits. As the strategy of leveraging wstETH/weETH against ETH becomes profitable again, market focus is shifting to the potential recovery of demand for ETH leveraged loops. Investors are currently hesitant, with capital either remaining on the sidelines or moving towards alternative protocols like Spark and Morpho. Key Points: • ETH utilization rate dropped below 90% following the rsETH bridge attack. • Deposits of wstETH and weETH decreased by approximately $1.2 billion and $1.76 billion, respectively. • Market interest is shifting towards the recovery of ETH leveraged loops amidst falling lending APY.
Detailed Analysis
**Impact** The rsETH LayerZero cross-chain bridge attack has led to a significant reduction in deposits, with approximately $1.2 billion withdrawn from wstETH and $1.76 billion from weETH. The ETH utilization rate dropped below 90%, and lending APY fell to 1.9%, indicating decreased market activity and liquidity. This event affects DeFi protocols relying on ETH leveraged loops, primarily impacting users and platforms engaged in wstETH/weETH collateralized lending strategies. The geographic scope is global, given the decentralized nature of Ethereum-based assets. **Technical Details** The attack targeted the rsETH LayerZero cross-chain bridge, exploiting vulnerabilities in the bridge infrastructure to drain or disrupt asset deposits. Specific TTPs, malware, CVEs, or IOCs were not disclosed in the available reports. The incident occurred during the exploitation phase of the kill chain, focusing on cross-chain asset manipulation or theft. **Recommended Response** Defenders should monitor cross-chain bridge activity closely for abnormal deposit or withdrawal patterns and enforce stricter access controls on bridge smart contracts. It is critical to audit and patch any vulnerabilities in LayerZero bridge implementations. Additionally, monitoring lending protocol metrics such as utilization rates and APYs can provide early indicators of market stress. No specific IOCs or patches were provided in the reports.
Source articles (3)
- Analyst: Aftermath of rsETH Security Incident Continues; Demand for ETH Leveraged Loops ... — Odaily.News · 2026-05-18
Odaily Planet Daily News: On-chain analyst Tom Wan stated on platform X that the current ETH utilization rate has dropped below 90%, and the lending APY has fallen to 1.9%. Since the rsETH LayerZero c… - Analyst: The aftermath of the rsETH security incident continues, with a significant cooling of ... — Bitget · 2026-05-18
Odaily reported that on-chain analyst Tom Wan stated on the X platform that the current ETH utilization rate has dropped below 90%, and the lending APY has fallen to 1.9%. Since the rsETH LayerZero cr… - Odaily星球日报 — www.odaily.news · 2026-05-18
Odaily星球日报讯 链上分析师 Tom Wan 在 X 平台发文表示，当前 ETH 利用率已跌破 90%，借贷 APY 降至 1.9%。自 rsETH LayerZero 跨链桥遭攻击以来，wstETH 与 weETH 存款规模分别减少约 12 亿美元与 17.6 亿美元。随着 wstETH/weETH 对 ETH 的循环杠杆策略重新恢复盈利，市场关注点转向 ETH 循环杠杆需求是否会重新回归…
Timeline
- 2026-05-18 — rsETH LayerZero cross-chain bridge attacked: The attack led to significant financial losses in wstETH and weETH deposits, impacting the Ethereum market.
- 2026-05-18 — ETH utilization rate drops below 90%: Analyst Tom Wan reported a decline in ETH utilization, indicating reduced market activity post-attack.
- 2026-05-18 — Lending APY falls to 1.9%: The annual percentage yield for lending ETH has decreased significantly, reflecting market conditions after the attack.