Aave founder and CEO Stani Kulechov used a Paris conference stage last week to recast one of the worst stress events in decentralized finance as a win. Speaking at Proof of Talk, he argued that Aave proved its “resilience” after roughly $8.45 billion in deposits fled the lending protocol within 48 hours of April’s $292 million KelpDAO exploit. The framing drew immediate pushback, because Aave only stayed solvent after a roughly $300 million emergency bailout from its DAO and from Kulechov himself, and risk analysts say the episode left the protocol with an estimated $123.7 million in bad debt.
A DeFi bank run is a sudden wave of withdrawals that drains a lending protocol’s liquidity faster than it can be replenished, the same dynamic that topples traditional banks when depositors lose confidence at once.
- Roughly $8.45 billion left Aave within 48 hours of the April KelpDAO bridge exploit, one of the largest liquidity shocks DeFi has recorded.
- Kulechov called the outcome proof of Aave’s resilience at Proof of Talk in Paris, blaming third-party infrastructure rather than Aave’s own contracts.
- The protocol survived only after a roughly $300 million rescue: 25,000 ETH from the Aave DAO and 5,000 ETH from Kulechov personally.
- Risk firm LlamaRisk estimates the incident left Aave V3 with about $123.7 million in bad debt; Aave is now building a V4 redesign to contain contagion.
Published: June 9, 2026 09:00 UTC
What triggered the run
The crisis did not start inside Aave. In April, an attacker exploited KelpDAO’s cross-chain bridge, which was powered by LayerZero, to mint roughly 116,500 unbacked rsETH tokens worth about $293 million. Those worthless tokens were deposited into Aave as collateral and used to borrow real wrapped ether, draining genuine assets from the pool.
A cross-chain bridge is software that lets tokens and messages move between separate blockchains, and it has become one of the most frequently attacked parts of the crypto stack. Risk researchers traced the KelpDAO breach to an RPC-spoofing and distributed denial-of-service attack on LayerZero verifier nodes, and several analysts have linked the operation to North Korea’s Lazarus Group. The fallout reached Aave within hours as users rushed to pull funds before any bad debt could be socialized across depositors. The wider market backdrop did not help, with institutions already rotating capital out of major assets during a volatile stretch.
Why the resilience claim is contested
“Aave has been really resilient during really turbulent times,” Kulechov told the Proof of Talk audience, drawing a line between failures in supporting infrastructure and flaws in DeFi applications themselves. His argument: smart contract security at major lending protocols has improved, and the real danger now sits in the third-party systems those protocols depend on.
Critics counter that survival required heavy manual intervention. The Aave DAO committed 25,000 ETH to an emergency response package, and Kulechov added another 5,000 ETH, valued at about $8.4 million at the time. Blockchain risk-modeling firm LlamaRisk reported that a uniform socialization of losses would produce a roughly 15% depeg and leave Aave V3 with about $123.7 million in bad debt. A separate analysis from the Bank Policy Institute concluded that the run exposed weaknesses in DeFi insurance arrangements and showed how large withdrawals can create pressures that mirror a conventional bank run. CoinDesk reported that Kulechov deflected responsibility for the run on stage.
What comes next for Aave
Kulechov acknowledged that interconnected DeFi infrastructure creates new forms of systemic risk that demand architectural change. Aave Labs is preparing a V4 upgrade that replaces traditional pooled liquidity with a modular hub-and-spoke framework. The design is meant to apply localized risk premiums and isolate problematic collateral before losses spread across lending markets, a direct response to how the KelpDAO collateral poisoned the wider pool. Details of the exploit mechanics were documented by crypto.news and The Block.
The company is also pushing deeper into regulated territory. Aave Labs subsidiaries Push Labs Limited and Push Virtual Assets Limited recently received UK Financial Conduct Authority approval to operate as registered cryptoasset exchange providers, adding to the group’s existing FCA electronic money authorization and its EU MiCA registration from November 2025. For business readers, the takeaway is less about one protocol’s marketing language and more about a structural reality: DeFi’s largest lenders remain exposed to failures they do not control, and the next bridge exploit could test a different platform the same way. Regulators are watching, with the SEC having named digital assets a strategic priority through 2030.
Frequently asked questions
How much money left Aave during the bank run?
Roughly $8.45 billion in deposits left Aave within 48 hours of April’s KelpDAO bridge exploit. It ranks among the largest liquidity shocks in DeFi history, and the protocol stayed solvent only after a coordinated rescue worth about $300 million.
Was Aave’s own code exploited?
No. The attack hit KelpDAO’s LayerZero-powered bridge, not Aave’s smart contracts. But the unbacked tokens minted in that exploit were deposited into Aave and used to borrow real assets, leaving the lender with an estimated $123.7 million in bad debt.
What is Aave changing in response?
Aave Labs is building a V4 upgrade with a hub-and-spoke design that isolates risk by market. It is meant to apply targeted risk premiums and freeze specific collateral lines so a single bridge failure cannot drain the entire pool again.
