Aave Absorbs $8.45B Withdrawal Wave After rsETH Bridge Hack, Renewing DeFi Risk Concerns

ChainCatcher reports that Aave weathered roughly $8.45 billion in withdrawals after KelpDAO's rsETH cross-chain bridge was attacked in April 2026, with the protocol's core functions remaining operational in what became one of the largest liquidity stress tests in DeFi to date. The shock began with an exploit targeting KelpDAO's LayerZero cross-chain bridge, leading to the theft of about $292 million worth of rsETH. The loss immediately raised questions about rsETH's collateral value and solvency, and because rsETH was widely used as collateral across lending venues including Aave, risk transmission was rapid. As users rushed to pull funds, utilization in some Aave markets surged to 100%, and certain users temporarily could not withdraw. Aave's risk team responded by triggering emergency freezes and adjusting parameters to curb spillover. Aave founder Stani Kulechov said the episode underscored DeFi's growing maturity, arguing the protocol operated as intended under extreme conditions and highlighting the resilience of an on-chain, rules-based system. Independent analysts said the protocol avoided a systemic failure but the episode exposed persistent vulnerabilities in DeFi lending, including concentration risk, liquidity risk, and contagion driven by tight interconnections among protocols. They added that the actions of large borrowers can influence stability beyond what models may predict. Aave currently relies on multiple layers of controls such as loan-to-value (LTV) limits, liquidation thresholds, supply caps, borrowing caps, Isolation Mode, E-Mode, and governance mechanisms. Observers said these safeguards largely worked during the turmoil, but pointed to governance response times and risk modeling as areas that still need improvement to handle future, hard-to-anticipate shocks. The incident is viewed as evidence that DeFi platforms can withstand large-scale runs without external bailouts. Analysts cautioned that one stress event does not prove system safety, and that as composability deepens, a flaw in a single external asset or cross-chain bridge can still cascade quickly into a broader liquidity crisis.