Aave Founder Mounts a $8.45 Billion Withdrawal Panic Defense, as a V4 Upgrade Plans to Restructure the Risk Management System

ME News, June 8 (UTC+8): This April, KelpDAO’s LayerZero-based cross-chain bridge was attacked for $292 million, triggering a deposit run of up to $8.45 billion on the DeFi lending protocol Aave within 48 hours. In response to external doubts about the protocol’s risk-control capabilities, Aave founder and CEO Stani Kulechov said that this incident precisely proves Aave’s “resilience.” Speaking at the Paris Proof of Talk conference, Kulechov said that Aave V3 has gone through multiple market cycles and remained stable even under extreme market conditions.

He believes that recent DeFi security incidents mainly stem from third-party infrastructure rather than vulnerabilities in the protocol’s own smart contracts. However, according to risk analysis firm LlamaRisk, the attackers used the KelpDAO vulnerability to mint worthless collateral and deposit it into Aave, then withdraw the real wETH, leaving Aave V3 with approximately $123.7 million in bad debt.

To address the crisis, Aave DAO urgently allocated 25,000 ETH, and Kulechov himself also injected an additional 5,000 ETH, bringing the overall rescue scale to about $300 million. In response to the systemic risk that has been exposed, Aave is planning to overhaul its risk management architecture through an upgrade to V4. The new version will use a modular “Hub-and-Spoke” design, replacing the traditional liquidity pool model, so the protocol can apply independent risk pricing to different types of collateral and freeze specific collateral assets before risk spreads—reducing the likelihood of cascading liquidations triggered by cross-chain bridge failures. (Source: ChainCatcher)