Why Aave Continued to Work Despite Billions of Dollars Withdrawal
In April 2026, users withdrew $8.45 billion from Aave, the largest DeFi cryptocurrency lending platform, in just two days. The total value of assets locked (TVL) in the DeFi sector decreased by $13.21 billion over the same period. Despite this, Aave did not stop working for a single moment.
The reason was not the attack on Aave itself, but the hacking of another platform whose token was used by some users as collateral on Aave. The event shows the difference between a direct attack on a protocol and the risk that can arise from the assets that the protocol accepts as collateral.
Source: cointelegraph
What exactly happened?
On April 18, 2026, an attacker exploited a vulnerability in the bridge, or bridge, by which the Kelp DAO connects its rsETH token to other networks. rsETH is a so-called liquid restaking token that represents a position associated with ETH involved in restaking mechanisms. Through this vulnerability, the attacker extracted 116,500 rsETH tokens, worth about $292 million, without collateral on the original chain.
Instead of selling the stolen tokens immediately, the attacker deposited them on Aave V3 as collateral and borrowed about $190 million in wrapped ether. Some of the stolen funds were later bridged and exchanged for bitcoin via Thorchain, making it difficult to recover them.
Source: cointelegraph
Aave was not directly hacked, but he was exposed to the consequences of the incident
Aave’s smart contracts were not compromised. The problem was that Aave accepted rsETH as collateral, and that token suddenly lost its actual coverage. Positions related to rsETH have created a risk of shortfall, or so-called bad debt, depending on the further development of the value and coverage of this token.
Aave’s TVL, or the total value of locked assets, fell from $26.4 billion on April 18 to $17.95 billion just two days later. The AAVE token fell 16 to 20 percent, and one OTC investor withdrew over $490 million in wstETH and cbBTC in just a few hours. Peter Chung, head of research at Presto Research, pointed out that such events show how interconnected DeFi protocols are, so market concerns can spread to platforms that are not directly affected by the attack.
Source: cointelegraph
DeFi sector participants engage in coverage renewal
A few days later, the DeFi United initiative was launched, in which Lido and EtherFi offered thousands of ETH to renew the coverage of rsETH tokens, and Aave founder Stani Kulechov personally deposited 5,000 ETH. Arbitrum froze $71 million in ether that, according to available information, was linked to the attacker, although a legal dispute later arose over this freeze.
By May 7, Aave had completed the liquidation of the attacker’s last positions on Ethereum and Arbitrum, without even having to activate the Umbrella reserve. The renewal of full coverage of the rsETH token was still about ten percent delayed at that point, with the expected contributions of Circle, Ethena and other partners.
Source: cointelegraph
Where is Aave today?
Aave’s TVL returned above $15 billion as early as early May according to data available in August 2026, with growth of roughly 5 percent in the last month. The level is still far from the peak of $30.25 billion in November 2025, but part of that decline also comes from general market conditions, not just this attack.
The Kelp DAO, meanwhile, announced that it was moving rsETH from the LayerZero bridge to Chainlink’s CCIP protocol, following a dispute over who was responsible for the vulnerable configuration of the bridge. The whole case shows that the risks associated with DeFi protocols stem not only from the security of their own code, but also from the characteristics, infrastructure, and risks of the assets they accept as collateral.