In April 2026, a flaw in KelpDAO's LayerZero bridge caused withdrawals of $8.45 billion on Aave in less than 48 hours, the largest bank run in DeFi history. Stani Kulechov, founder of Aave Labs, presented the episode as proof of the protocol's robustness during Proof of Talk in Paris. The facts, however, paint a much less flattering picture.
In brief
- A $292 million mine on KelpDAO's LayerZero bridge sparked a massive run on Aave, with $8.45 billion in deposits withdrawn in 48 hours.
- Aave avoided insolvency with a $300 million emergency bailout mobilizing 25,000 ETH from the DAO and 5,000 personal ETH from Kulechov.
- The V4 upgrade, planned to replace the shared pool architecture with a modular star system, aims to isolate the risks of future contagion.
Kulechov on stage, resilience, really?
During the Proof of Talk event held in Paris last week, Stani Kulechov drew a parallel between decentralized finance and traditional banks, to the advantage of the former.
“ Aave has shown great resilience even in very turbulent times », he affirmed, without dwelling on the exact conditions for the survival of the protocol.
However, the independent data tells something different. According to analytics firm LlamaRisk, attackers exploited the flaw to create worthless collateral, deposited it on Aave, and then siphoned off genuine wETH, leaving the protocol with an estimated $123.7 million in uncollectible debt.
The rescue that followed was not automatic: 25,000 ETH mobilized by the Aave DAO, 5,000 ETH injected personally by Kulechov. In all, $300 million urgently coordinated by humans, not code.
Kulechov nevertheless refuted any responsibility for the central protocol. “ Issues with smart contracts in DeFi protocols are generally very rare, if any. Rather, these are third-party dependencies “, he clarified.
Technically, the attack actually began with RPC spoofing targeting LayerZero verification nodes, not a breach in Aave. But for analysts at the Bank Policy Institute, this framing obscures the essential: DeFi remains structurally vulnerable to bank runs, to the detriment of its users.
Aave V4, redesigning the architecture to compartmentalize risk
Faced with these shortcomings, Kulechov announced a major overhaul of risk management in the upcoming V4 upgrade. The central objective: to prevent future exploitation of a crypto bridge from contaminating all of the protocol's reserves.
The principle adopted is that of a modular star system. Concretely, this system would replace the current architecture of shared pools with isolated modules, capable of charging localized risk premiums and freezing specific guarantee lines before contagion reaches the main reserves.
With a fully auditable and public system, anyone can review code and perform different types of risk analyzes.
Furthermore, the question of insurance remains open. Analysts at the Bank Policy Institute noted that Aave's coverage proved insufficient given the scale of the crisis, a point that V4 does not directly address in the details communicated so far.
Ultimately, the April 2026 episode illustrates the persistent tension between DeFi's discourse of resilience and its real vulnerabilities. The rush on Aave, the emergency human intervention, the nine-figure bad debt: these elements converge to remind us that decentralized protocols are not yet immune to classic banking panic.
V4 promises a more robust architecture, but it is its actual deployment, and its resistance to the next stress test, which will decide the question. In the meantime, institutional DeFi continues to watch. Not yet convinced.
Maximize your Tremplin.io experience with our 'Read to Earn' program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
