Aave suffered US$8.45 billion in withdrawals during rsETH crisis, market controversy resurfaces over DeFi's risk management capabilities

After KelpDAO's rsETH cross-chain bridge was attacked in April 2026, Aave experienced the withdrawal of approximately US$8.45 billion, but the core functions of the agreement did not fail and successfully completed one of DeFi's largest liquidity stress tests to date. The crisis originated from the attack on KelpDAO's LayerZero cross-chain bridge and the theft of approximately US$292 million of rsETH, raising market concerns about the value and solvency of rsETH collateral. Since rsETH was widely used as collateral assets in agreements such as Aave, risks spread rapidly, resulting in concentrated withdrawals of funds by users. The utilization rate of some markets once reached 100%, and some users were unable to withdraw funds immediately. Faced with tight liquidity, Aave risk management team launched an emergency freeze and parameter adjustment mechanism to limit the spread of risks. Aave founder Stani Kulechov viewed the incident as proof of DeFi's increased maturity, arguing that the protocol still operated as designed under extreme pressure, demonstrating the resilience of a transparent, rules-driven system on the chain. However, several independent analysts pointed out that although Aave avoided a systemic collapse, the incident exposed that the DeFi lending system still has concentration risks, liquidity risks and contagion risks caused by the high degree of interconnection between protocols. The behavior of large borrowers may have an impact on overall system stability that exceeds model expectations. Aave currently controls risks through multiple layers of protection measures such as loan-to-value ratio (LTV) limits, clearing thresholds, supply caps, borrowing caps, IsolationMode, E-Mode, and governance mechanisms. These mechanisms have played an overall role in this crisis, but observers believe that governance response speeds and risk models still need to be further optimized to cope with unknown systemic shocks in the future. Analysts believe that this incident shows that the DeFi protocol can withstand large-scale runs without external assistance, but a single stress test cannot fully prove the security of the system. As the composability between agreements continues to increase, an external asset or cross-chain bridge problem may still quickly turn into a liquidity crisis for the entire ecosystem.