Aave survived $8.45B withdrawals but revealed deeper DeFi risks

In April 2026 attackers exploited the KelpDAO rsETH LayerZero bridge, stealing about $292 million in rsETH and triggering widespread concern about that token’s backing. The panic spread to Aave, where users withdrew roughly $8.45 billion. Aave’s smart contracts were not compromised, but the incident stressed the protocol through collateral, borrowing and liquidity channels and forced the use of emergency controls.

Views on the outcome diverged. Founder Stani Kulechov said the core protocol held up and demonstrated resilience, while independent analysts warned that surviving one stress event is not the same as proving the system is safe. As withdrawals mounted, some pools hit full utilization and risk managers relied on freezes and parameter changes to contain damage, illustrating how quickly liquidity strains can make exits difficult.

Aave’s design includes visible on-chain collateral, public risk settings, liquidation rules, supply and borrow caps, Isolation Mode, E-Mode and governance with risk advisers.

aave, defi, layerzero, kelpdao, rseth, withdrawals, liquidity strains, emergency controls, stani kulechov, liquidation rules