Aave faced a withdrawal onslaught of $8.45 billion during the rsETH crisis, reigniting debate on DeFi risk management capability

June 19, 2026 — following an April 2026 attack on KelpDAO’s rsETH cross-chain bridge, Aave saw roughly $84.5 billion in user funds flow out of its protocol. Even so, Aave’s core functionality remained fully intact, marking one of the largest DeFi stress tests to date that the platform passed successfully. The crisis originated with an attack on KelpDAO’s LayerZero cross-chain bridge, which led to the theft of about $292 million worth of rsETH. This sparked widespread market anxiety over rsETH’s value and solvency as collateral. Since rsETH is used as collateral across multiple DeFi protocols, including Aave, the risk spread rapidly, triggering a massive wave of withdrawal requests. Some Aave markets hit 100% utilization rates, leaving some users temporarily unable to access their funds. To address the emerging liquidity crunch, Aave’s risk management team implemented emergency freezes and adjusted key parameters to contain risk contagion. Aave founder Stani Kulechov called the incident a proof point of DeFi’s growing maturity, noting that the protocol operated exactly as designed under extreme pressure—demonstrating the resilience of a transparent, rules-based on-chain system. However, several independent analysts pointed out that while Aave avoided a total systemic collapse, the event exposed critical vulnerabilities: concentration risks, liquidity gaps, and contagion risks driven by the DeFi lending ecosystem’s high level of interconnectivity. They added that large borrowers’ actions can impact system stability in ways that existing risk models fail to account for. Aave currently mitigates risks through several layered safeguards, including Loan-to-Value (LTV) caps, liquidation thresholds, supply limits, borrowing limits, Isolation Mode, E-Mode, and on-chain governance mechanisms. These tools performed mostly as intended during the crisis, but observers argue that Aave needs to improve its governance response speed and refine its risk models to address unforeseen systemic shocks in the future. Analysts believe this event illustrates that DeFi protocols can withstand large-scale fund runs without external assistance—but one stress test alone can’t fully prove a system is secure. As composability between DeFi protocols continues to grow, a problem with an external asset or cross-chain bridge could quickly escalate into a liquidity crisis for the entire ecosystem.