Feed

Aave Founder Defends Protocol After $8.45B Deposit Run

Aave Labs founder Stani Kulechov defended the lending protocol’s resilience after an April exploit tied to KelpDAO’s LayerZero bridge triggered an $8.45 billion withdrawal wave. The episode has intensified scrutiny of DeFi risk controls as Aave prepares a V4 redesign aimed at limiting contagion from external infrastructure failures.

What happened?

Aave Labs founder Stani Kulechov defended the lending protocol’s resilience after an April exploit tied to KelpDAO’s LayerZero bridge triggered an $8.45 billion withdrawal wave. The episode has intensified scrutiny of DeFi risk controls as Aave prepares a V4 redesign aimed at limiting contagion from external infrastructure failures.

Why it matters

Aave Labs founder and CEO Stani Kulechov defended the protocol after an April 2026 crisis in which a $292 million exploit of KelpDAO’s LayerZero-powered bridge helped trigger an $8.45 billion deposit run on Aave within 48 hours, according to CoinDesk. Speaking at the Proof of Talk event in Paris, Kulechov framed the episode as evidence that Aave’s V3 infrastructure remained resilient through severe market stress.

Aave Labs founder and CEO Stani Kulechov defended the protocol after an April 2026 crisis in which a $292 million exploit of KelpDAO’s LayerZero-powered bridge helped trigger an $8.45 billion deposit run on Aave within 48 hours, according to CoinDesk. Speaking at the Proof of Talk event in Paris, Kulechov framed the episode as evidence that Aave’s V3 infrastructure remained resilient through severe market stress.

The incident matters because Aave is one of decentralized finance’s largest lending platforms, and the run showed how problems outside a protocol’s own code can still spread into core lending markets. CoinDesk reported that the exploit allowed attackers to mint worthless collateral, place it into Aave, and drain real wrapped ether, leaving Aave V3 with an estimated $123.7 million in bad debt, according to LlamaRisk.

Kulechov argued that many recent DeFi failures have stemmed from third-party dependencies rather than defects in major protocol smart contracts. CoinDesk noted that the April attack involved RPC spoofing and a DDoS attack targeting LayerZero verifier nodes on KelpDAO, rather than a direct bug in Aave’s code.

Even so, Aave’s recovery relied on emergency human coordination. CoinDesk said the response included a roughly $300 million bailout effort, with 25,000 ETH pledged by the Aave DAO and 5,000 ETH contributed personally by Kulechov.

Aave Labs is now preparing a V4 upgrade intended to change how risk is managed. Kulechov said the new architecture will use a modular hub-and-spoke design instead of pooled token structures, with tools to apply localized risk premiums and freeze specific collateral lines before problems spread into primary reserves.

Source: CoinDesk