Aave faces bank-run fallout after LayerZero bridge exploit; V4 risk redesign announced

Aave is defending its “resilience” after a LayerZero bridge attack sparked an $8.45 billion, 48-hour deposit bank run in April 2026. The trigger was a $292 million exploit of KelpDAO’s LayerZero-powered bridge, which analysts say was used to mint worthless collateral, deposit it into Aave, and drain authentic wETH. Aave survived mainly through emergency intervention rather than flawless risk automation. A chaotic $300 million bailout included 25,000 ETH pledged by the Aave DAO and 5,000 ETH from founder Stani Kulechov. LlamaRisk estimates Aave V3 later carried about $123.7 million in bad debt, while other analysts cited inadequate insurance as a key reason depositors rushed to withdraw. At Proof of Talk in Paris, Aave CEO Stani Kulechov argued the smart contracts themselves were sound and that vulnerabilities came from third-party dependencies (e.g., external infrastructure and bridge components). But the episode has reignited debate about whether major DeFi lending markets can truly withstand systemic stress. Looking ahead, Aave says its upcoming V4 upgrade will replace pooled token design with a modular “hub-and-spoke” system. The goal is to localize risk, add targeted premiums, and allow the protocol to freeze specific collateral lines before contagion reaches core lending reserves—aiming to prevent future bridge failures from triggering bank-run-style withdrawals. For traders, the key issue is execution risk during upgrades versus the potential for improved capital-protection mechanics in Aave V4.