A single forged cross-chain message exposed 116,500 rsETH and triggered an industry-wide DeFi recovery effort.