rsETH incident — 2026-04-18

back to that time, if user don’t withdraw, attacker might drain again.