BlockBeats reported on June 19 that Aave experienced roughly $8.45 billion in withdrawals after KelpDAO’s rsETH cross-chain bridge was attacked in April 2026. Despite the scale of the outflows, Aave’s core protocol functions did not break down, making the episode one of the largest liquidity stress tests DeFi has faced to date.
The rsETH exploit and collateral concerns
The crisis began with an attack on KelpDAO’s LayerZero cross-chain bridge, in which about $292 million worth of rsETH was stolen. The incident triggered concerns over the value of rsETH as collateral and over its solvency profile. Because rsETH had been widely used as collateral in protocols including Aave, the risk quickly spread into DeFi lending markets.
As users rushed to withdraw funds, utilization in some Aave markets reached 100% at one point, leaving some users unable to withdraw immediately. In response to the liquidity strain, Aave’s risk management team activated emergency freezes and parameter adjustments designed to limit further risk transmission across the protocol.
Aave founder Stani Kulechov described the event as evidence of DeFi’s increasing maturity. In his view, the protocol continued to operate as designed under extreme stress, showing the resilience of an on-chain, transparent and rules-based system.
Governance response and risk models remain in focus
Several independent analysts noted that although Aave avoided a systemic collapse, the event exposed continuing weaknesses in DeFi lending architecture. The issues cited included concentration risk, liquidity risk and contagion risk created by the high degree of interconnection among protocols. The behavior of large borrowers was also identified as a factor that can affect overall system stability beyond what models had anticipated.
Aave currently uses multiple layers of risk controls, including loan-to-value limits, liquidation thresholds, supply caps, borrow caps, Isolation Mode, E-Mode and governance mechanisms. These measures broadly functioned during the crisis, but observers said governance response speed and risk models still need further optimization to handle unknown systemic shocks in the future.
The episode showed that a DeFi protocol can withstand a large-scale run without external rescue. At the same time, a single stress test does not fully prove system safety. As composability between protocols continues to increase, a problem involving an external asset or a cross-chain bridge can still rapidly turn into a liquidity crisis across the wider ecosystem.