The attacker, whose origins are as murky as a Moscow fog, traced back to Tornado Cash, exploited a flaw in rsETH’s minting logic. With the finesse of a petty bureaucrat, they minted tokens without collateral-a financial sleight of hand that would make even the most jaded con artist blush. These phantom tokens were then deposited into Aave V3 and V4, where they served as collateral for borrowing WETH. By the time KelpDAO’s emergency “pauseAll” function was triggered-46 minutes after the heist began-the damage was done. Two subsequent attempts to drain an additional $100 million were thwarted, but the initial blow had already left the ecosystem reeling.