Aave avoided collapse, but its $8.45B stress test exposed deeper risks

1. A stress test that showed both strengths and weaknesses

When large sums leave a financial system quickly, hidden weaknesses often become visible. In traditional finance, such situations often lead to emergency lending programs, withdrawal limits or government-backed bailouts.

Decentralized finance (DeFi) works differently.

Aave is one of crypto’s biggest lending platforms. In April 2026, users withdrew about $8.45 billion from the protocol after the KelpDAO rsETH bridge exploit raised concerns across DeFi markets.

Aave’s own smart contracts were not compromised. The pressure came from an external rsETH bridge incident that affected Aave through collateral, borrowing and liquidity channels. The protocol’s core logic continued to function, but the episode was not smooth. Some markets came under severe liquidity pressure, and emergency controls were used to contain the damage.

That made the outcome more complicated. Aave avoided a full breakdown, but the event also showed how quickly stress can spread when assets, collateral and liquidity are closely connected.

For Aave founder Stani Kulechov, the event showed that DeFi had become more mature. But independent analysts reviewing the same data took a more cautious view.

While Aave survived, many questioned whether surviving the event was enough to answer concerns about the real strength of DeFi lending protocols.

2. What led to the $8.45B in withdrawals

The pressure did not begin with a hack on Aave itself. It began with the KelpDAO rsETH bridge exploit in April 2026.

Attackers stole about $292 million worth of rsETH from KelpDAO’s LayerZero bridge. That raised concerns about whether some rsETH tokens were fully backed. The concern quickly spread because rsETH was used across DeFi, including as collateral in Aave markets.

This created a direct problem for Aave. If collateral tied to rsETH lost trust or value, lenders could face bad-debt risk. Users began withdrawing funds as they tried to reduce their exposure before conditions became worse.

The withdrawals then added pressure to Aave’s liquidity. As more users pulled funds, some markets became highly utilized. In simple terms, most of the available liquidity had already been borrowed or withdrawn, making it harder for some users to exit immediately.

The incident showed how an external asset problem can still affect a lending protocol. In DeFi, assets often move across bridges, lending markets and other protocols. A problem in one part of the system can quickly affect another.

That is what made the episode look like a DeFi bank run. Users were not waiting for branches to open or banks to approve transfers. They could react in real time. But the event also showed an important limit: users can try to withdraw at any time, but actual withdrawals still depend on available liquidity and protocol conditions.

Did you know? The largest bank runs in history often unfolded over days or weeks. In DeFi, similar events can happen within hours because blockchain protocols never close, and users can move funds instantly from anywhere in the world.

3. Stani Kulechov’s view: The system held firm

Kulechov framed the incident as evidence of Aave’s resilience. In his view, the core protocol worked as designed, even during a period of heavy stress.

That distinction matters. Aave did not suffer a protocol exploit, but the markets around it still came under pressure. 

As withdrawals increased, some markets reached full utilization. That meant liquidity became limited in those markets, making it harder for some users to withdraw immediately. Aave’s risk managers also had to use built-in controls, including emergency freezes and changes to risk parameters, to contain the damage.

Seen this way, Aave did pass an important real-world stress test, but not without strain. Supporters of the platform point to several features that set DeFi apart from traditional finance.

• Collateral is visible on-chain.
• Risk settings are publicly available.
• Liquidations follow smart contract rules.
• Anyone can inspect protocol activity in real time.

These features can reduce some of the information gaps that have contributed to banking crises in the past. But they do not remove every risk. DeFi lending protocols can still face problems from external assets, bridges, liquidity shortages and fast-moving user behavior.

To supporters, Aave’s survival showed that open, rule-based systems can keep operating under heavy pressure. To critics, the incident showed that transparency alone is not enough. DeFi can still require emergency action when liquidity stress spreads across connected markets.

4. Survival does not mean safety

Critics warn against treating the outcome as full proof that Aave’s design is safe. The protocol survived, but that does not mean every part of the system worked perfectly.

Stress events can be read in different ways. Strong design may explain part of Aave’s performance, but favorable market conditions may have also…