Aave endured a $8.45 billion withdrawal wave during the rsETH crisis, reigniting debates over DeFi's risk management capabilities.

BlockBeats News message, June 19 — After Aave was attacked in April 2026 at KelpDAO’s rsETH cross-chain bridge, it saw approximately $8.45 billion in funds withdrawn, but there was no failure in the protocol’s core functions, successfully completing one of the largest liquidity stress tests in DeFi to date.

The crisis was triggered by an attack on KelpDAO’s LayerZero cross-chain bridge, during which about $292 million worth of rsETH was stolen, sparking market concerns about the value of rsETH collateral and its ability to meet obligations. Since rsETH is widely used as collateral by protocols such as Aave, the risk spread rapidly, leading to users withdrawing funds in concentrated waves; for a time, some markets’ utilization reached 100%, and some users were unable to withdraw funds immediately.

In response to liquidity tightness, Aave’s risk management team activated an emergency freezing and parameter adjustment mechanism to limit the spread of risk. Aave founder Stani Kulechov viewed this incident as a proof that DeFi has matured further, believing that even under extreme pressure the protocol continued to operate as designed, demonstrating the resilience of an on-chain transparent, rules-driven system.

However, multiple independent analysts noted that although Aave avoided a systemic collapse, the event exposed that DeFi lending systems still face concentration risk, liquidity risk, and contagion risk arising from the high level of interconnectedness among protocols. The actions of large borrowers could have an impact on the stability of the entire system beyond what the models predicted.

Aave currently controls risk through multiple layers of safeguards, including loan-to-value (LTV) limits, liquidation thresholds, supply caps, borrow caps, Isolation Mode, E-Mode, and governance mechanisms. Overall, these mechanisms played a role during this crisis, but observers believe that the governance response speed and risk models still need further optimization to better address future unknown systemic shocks.

Analysis suggests that this incident shows DeFi protocols can withstand large-scale withdrawals without external rescue, but a single stress test cannot fully prove system security. As composability between protocols continues to strengthen, an issue with an external asset or cross-chain bridge could still quickly evolve into a liquidity crisis across the entire ecosystem.