According to ChainCatcher, Aave experienced roughly $8.45 billion in withdrawals after KelpDAO’s rsETH cross-chain bridge was attacked in April 2026. Despite the scale of the liquidity pressure, the protocol’s core functions did not malfunction. The episode became one of the largest liquidity stress tests seen so far in DeFi.
KelpDAO Bridge Exploit Triggers Collateral Concerns
The crisis began with an attack on KelpDAO’s LayerZero cross-chain bridge, in which about $292 million worth of rsETH was stolen. After the incident, concerns emerged around the value of rsETH as collateral and its solvency. Because rsETH had been widely used as a collateral asset in protocols including Aave, the risk spread quickly across lending markets.
As users rushed to withdraw funds, utilization in some markets briefly reached 100%, and some users were unable to withdraw immediately. In response to the liquidity strain, Aave’s risk management team activated emergency freezes and parameter adjustments designed to limit the spread of risk.
Aave founder Stani Kulechov described the incident as evidence of DeFi’s growing maturity. In his view, the protocol continued to operate as designed under extreme pressure, showing the resilience of an on-chain, transparent and rules-based system.
Risk Controls Work, but Interconnected Markets Remain Exposed
Several independent observers noted that although Aave avoided a systemic collapse, the event exposed remaining risks in DeFi lending, including concentration risk, liquidity risk and contagion risk created by the high level of interconnection between protocols. The behavior of large borrowers can affect overall system stability in ways that exceed the assumptions built into risk models.
Aave currently manages risk through multiple protective layers, including loan-to-value limits, liquidation thresholds, supply caps, borrowing caps, Isolation Mode, E-Mode and governance mechanisms. These mechanisms generally functioned during the crisis. However, observers said governance response speed and risk models still need further optimization to handle future unknown systemic shocks.
The analysis cited by ChainCatcher said the event shows that DeFi protocols can withstand a large-scale bank-run-like withdrawal without external rescue. At the same time, a single stress test cannot fully prove system safety. As composability between protocols continues to increase, a problem involving an external asset or a cross-chain bridge can still quickly develop into a liquidity crisis across the broader ecosystem.