The Aave bank run was approved by governance six months before it happened.

A $292M bridge exploit. Six billion dollars out the door. The largest lending protocol in DeFi carrying a hole it didn't choose. A timeline, an anatomy, and what the rest of us should take from it.

At 17:35 UTC on Saturday, April 18, 2026, an attacker called the lzReceive function on LayerZero's EndpointV2 contract and convinced Kelp DAO's rsETH bridge that a valid cross-chain message had arrived from Unichain.¹¹ It had not. The bridge released 116,500 rsETH — roughly $292 million, about 18% of the entire circulating supply — to an address the attacker controlled.¹² That was the first half of the problem.

The second half played out on Aave. The attacker deposited the stolen rsETH as collateral on Aave V3, borrowed wrapped ether against it, and when Kelp paused rsETH contracts forty-six minutes later, the collateral became worthless and the loan became unliquidatable.¹⁵ Aave was left holding approximately $196 million in bad debt on a Saturday night.¹³ By Sunday morning, the largest lending protocol in DeFi was having a bank run.

I want to walk through what actually happened, because the story being told in most headlines — Aave got hit by an external exploit — is technically true and completely beside the point. The more honest story is this: Aave's governance spent the six months leading up to April 18 quietly approving the exact set of parameters that turned a bridge exploit on a different protocol into a withdrawal crisis on theirs. The code worked as written. The rules worked as approved. The bill arrived on time.

Wish I had better news but looks like WETH on Aave is fucked. Withdraw if you can but likely too late.— 0xQuit, Solidity developer, on X · April 18, 2026 (as circulated in contemporaneous reporting)

§ 01   The EventWhat happened in forty-six minutes

The exploit itself was narrow and technical. Kelp DAO operates rsETH, a liquid restaking token that takes already-staked ETH, routes it through EigenLayer, and issues a receipt that earns restaking rewards while remaining tradeable.¹¹ Before Saturday, Kelp held over $1.3 billion in TVL across more than twenty networks. rsETH on every non-Ethereum chain is not really an independent token — it is a withdrawal order against the reserve held by a single contract on Ethereum called the OFTAdapter.²⁹

That OFTAdapter sits behind LayerZero's cross-chain messaging layer. LayerZero's security model relies on Decentralized Verifier Networks (DVNs) — sets of validators that attest to the authenticity of messages between chains. Kelp's configuration used a 1-of-1 DVN, meaning a single validator signature was enough to authorize a cross-chain release.²⁹ This is the weakest security setting LayerZero allows. Fifteen months after Kelp deployed, a second DVN had not been added.²⁹

At 17:35 UTC, the attacker sent a forged message through that single verifier. The OFTAdapter released 116,500 rsETH without any corresponding burn on a source chain.²⁹ In omnichain accounting, debit and credit have to balance. They didn't. From that moment on, rsETH as a cross-chain asset was undercollateralized by $292 million.

The technical attack surface was Kelp's. The blast radius was Aave's. That asymmetry is the entire story.

§ 02   The MechanicsWhy Aave absorbs what Kelp loses

When someone deposits collateral on Aave and borrows against it, Aave relies on two things to make sure lenders get paid back: the collateral is worth what the oracle says it's worth, and if the borrower's health factor drops, someone will step in to liquidate the position and recover the debt. Both assumptions failed simultaneously.

The collateral was worth zero because the reserve backing it on Ethereum had been drained. But Aave's oracle hadn't yet caught up — and even if it had, Aave used an E-Mode configuration for the rsETH/WETH pair that explicitly assumed the two assets were "highly correlated." In E-Mode, the system treats the collateral as stable relative to the debt. When rsETH's market price started collapsing, E-Mode's correlation assumption prevented normal liquidation paths from triggering.¹⁰ Positions that should have been liquidated at a small loss instead locked in as bad debt at a catastrophic one.

With 116,500 rsETH as collateral and a 93% E-Mode LTV, the attacker could mathematically borrow up to roughly $272M in WETH — approximately $62M more than a conventional 72% LTV would have allowed.¹⁰ The safety buffer between collateral value and debt compressed from 28% to 7%. That 7% was what separated solvency from a nine-figure hole.

Once the bad debt became public, depositors ran. Aave's book is heavily concentrated on Ethereum — $14.24B of the $17.82B in outstanding borrows — and WETH alone makes up 39.49% of all loans across the protocol.¹³ The attack hit the exact collateral-to-debt pair that dominates Aave's entire book. This was not a marginal market; this was the center of the book. If you wanted to check your own exposure live during the run, on-chain views like LeoDex's Aave protocol page and the AAVE token page were the fastest way to watch the pool stress in real time.

On a lending protocol, when utilization hits 100%, withdrawals mechanically stop. There's no idle liquidity left in the pool for suppliers to redeem against. Your deposit isn't gone — it's just borrowed by someone else, and you can't pull it until either the borrowers repay or new depositors arrive. That's what a DeFi bank run looks like: a pool at 100% utilization with a queue of people clicking withdraw and watching nothing happen.

§ 03   The Governance TrailSix months, four decisions

This is the part of the story that does not show up on the price chart but explains everything about why the damage landed where it did. The loss-of-value path runs through four governance decisions over a six-month window.

January 19, 2026 — AIP-434

The Aave community passes governance proposal 434, driven by the Aave Chan Initiative (ACI). The proposal adds WETH to rsETH's LST E-Mode and lifts the maximum LTV from 92.5% to 93%.¹⁰ The stated rationale is to absorb "up to $1 billion of rsETH inflow" through an rsETH/WETH looping strategy, and to remain "competitive" with LTV parameters already granted to ezETH and weETH.¹⁰

Two other major lending protocols accepting rsETH used very different parameters at the same moment. SparkLend capped rsETH LTV at 72%. Fluid's minimum collateral ratio equated to roughly 75% LTV.¹⁰ Aave's 93% was 18–21 percentage points more aggressive. When the event hit on April 18, both SparkLend and Fluid froze their rsETH markets within hours and reported minimal or zero exposure.²¹

April 6, 2026 — Chaos Labs exit

Chaos Labs, which had managed Aave's risk parameters for three years while TVL grew from $5.2B to $26B+, announces its departure.¹⁰ Founder Omer Goldberg cites a fundamental disagreement on risk strategy, uncompensated complexity from V4, and an economically unsustainable position even at a $5M budget.¹⁰ "This partnership no longer reflects how we believe risk should be managed," he writes.

Stani Kulechov responds that operations will continue, with LlamaRisk absorbing full responsibilities. LlamaRisk pledges "full operational continuity."¹⁰

April 9, 2026 — Supply cap increase

Three days into its expanded role, LlamaRisk submits a routine Risk Stewards adjustment increasing the rsETH supply cap on Aave V3 Ethereum Core from 480,000 to 530,000 tokens. Justification: on-chain data health, healthy utilization, sufficient liquidity, concentration within thresholds.¹⁰ All metrics on-chain. No metric in the dataset asks what kind of bridge the underlying rsETH crossed before it reached Aave.

April 18, 2026 — 17:35 UTC

The bridge LlamaRisk's metrics did not measure releases 116,500 rsETH into an attacker's wallet. Within minutes, that rsETH is supplied to Aave V3 as collateral under the 93% LTV that AIP-434 approved, against the WETH that AIP-434 had whitelisted as the borrow asset. The code executes exactly as designed.¹⁰

The code ran as approved. The bill was sent to those who were not part of those approvals.— BlockBeats, on the rsETH incident · April 19, 2026

There is a tendency in DeFi reporting to treat risk parameters as minor bookkeeping — "the LTV went from 92.5% to 93%, nothing to worry about." But a 93% E-Mode LTV is the difference between a protocol that absorbs a collateral shock and one that has to run its Safety Module. Every percentage point of LTV is a cap on how much pain the protocol can take before the margin of safety becomes negative. ACI's competitive-benchmarking logic — "ezETH has it, weETH has it, rsETH should have it too" — is the kind of reasoning that feels neutral in a forum post and looks suicidal in a post-mortem.

§ 04   The BackstopUmbrella's first real test

Aave does have a mechanism specifically designed to absorb exactly this class of event. It's called Umbrella, and it replaced the legacy Safety Module in late 2025.⁵ Users stake aTokens (aUSDC, aUSDT, aWETH) or GHO into Umbrella vaults, earn boosted yield, and agree to be slashed if a deficit develops in the corresponding asset pool.

The key architectural change: Umbrella slashes automatically, via smart contract, without a governance vote. The legacy Safety Module required governance to authorize slashing — and in five years, through multiple bad-debt events including the 2022 Curve exploit, it never actually slashed.³² Umbrella was built to solve that credibility problem.

Here is the order of operations if Umbrella activates for this event:

1. aWETH stakers in the WETH Umbrella vault are slashed first. Their aTokens are burned and the underlying assets are sent to the Aave Collector to cover the deficit.⁵
2. If that doesn't cover the shortfall, stkAAVE and stkABPT holders face up to 20% slashing — the first slashing of AAVE stakers in the protocol's history.⁶
3. If that still doesn't cover it, remaining WETH suppliers take a haircut. Per Aave's own docs, "a full recovery is not guaranteed."⁴

The math is uncomfortable. Forbes-cited estimates put the aWETH Umbrella vault at roughly $50 million in coverage capacity.¹⁰ The bad debt is estimated at $177M–$200M.²¹ The gap — somewhere between $127M and $150M — has to come from either stkAAVE slashing, DAO treasury absorption, or depositor haircuts. Most likely some combination.

The clearest tell that Aave is not certain about coverage: the language migration. The initial public statements said Umbrella "can be used to offset the deficit." By Saturday afternoon, this had softened to "explore paths to offset the deficit."¹³ That is not how a protocol communicates when it knows the size of the hole and has the capital to fill it.

§ 05   The RunWhy $5.4 billion walked in an afternoon

DeFi bank runs are faster than traditional ones for a reason that should be obvious but often isn't: there is no FDIC, no Fed discount window, no counter queue, no "we're closing early and opening Monday." There is only utilization, and when utilization hits 100%, the exit is mechanically closed until the borrowers repay. Anyone who understands that math exits before it happens, not after.

Justin Sun, acting through a wallet Lookonchain links to him, pulled 65,584 ETH (approximately $154M) in a single move.²⁰ This is not his first pattern of this kind — in July 2025, Sun-linked wallets and HTX withdrew over $1.1B from Aave over the course of a week, forcing borrowing rates above 10% and prompting Aave contributor Marc Zeller to publicly compare it to "grocery shopping."³¹ The difference on April 19 is that Sun was not moving first — he was moving with the crowd.

Three whale wallets dumped approximately 60,000 AAVE at $100–$103 within a tight window, suggesting coordinated concern rather than random profit-taking.²³ Sophisticated capital doesn't sit around waiting for an Umbrella post-mortem; it exits first and reads the thread on the way out.

By late Sunday, the AAVE token was testing the $88–$92 demand zone, RSI at 13.56 on the 6-hour chart, deep in oversold territory.²³ Contract net flow was negative across every timeframe (24H: −$18.7M), indicating capital flight from the futures market.²³

Worth noting what didn't happen. Aave's USDC and USDT markets did not show stress from direct rsETH exposure — the bad debt is narrowly concentrated in the WETH pool. Marc Zeller publicly confirmed stablecoin markets were unaffected.²² The run was concentrated where the exposure was, which is a feature, not a bug. But "concentrated" and "contained" are not the same thing.

§ 06   The OutcomesFive scenarios from here

1. Umbrella covers, cleanly

   aWETH vault is slashed, the deficit is absorbed, stkAAVE is untouched, WETH depositors take no haircut or a very small one. This is the scenario that vindicates the Umbrella redesign and becomes a proof point for automated insurance. Requires actual coverage capacity to exceed actual bad debt — currently in doubt.
2. Umbrella short, stkAAVE slashed

   aWETH exhausts without closing the gap. stkAAVE holders face the first real slashing in Aave history, up to 20% of staked position. Legacy Safety Module never slashed despite multiple bad-debt events; Umbrella does, and that changes the credibility calculus of every future staking decision across DeFi.
3. DAO treasury absorbs the remainder

   A governance proposal socializes the residual loss via treasury draw. Politically difficult right after AIP-469 approved a $25M grant to Aave Labs under the "Aave Will Win" framework.³⁴ Sets a dangerous precedent about who pays when risk parameters fail: the DAO.
4. Prolonged queue, no formal slash

   Neither Umbrella nor the DAO moves decisively. Borrowers slowly unwind, utilization normalizes over days or weeks, rates spike, depositors sit in illiquid positions. Everyone gets most of their money back eventually but the mental model of Aave as "instant liquidity" is permanently revised.
5. Contagion to other LRT-accepting protocols

   Further depegs or unresolved questions about rsETH backing on L2s trigger cascading freezes across SparkLend, Fluid, Morpho, Euler. Lowest probability, highest consequence. The structural question — whether LRTs should be blue-chip lending collateral at all — becomes an industry-wide re-examination.³⁷

§ 07   The ReadingWhat this event is actually about

Three things matter for how you read this, and they're not the same thing the market is pricing right now.

1. The composability premium has a composability tax.

Liquid restaking tokens were whitelisted as collateral on Aave, SparkLend, Fluid, Compound, Euler, and every major lending venue of 2025–2026 because they were yield-bearing, growing fast, and represented an increasing share of Ethereum's locked value.¹³ The composability case was strong: you could stake ETH, restake into EigenLayer, mint an LRT, post it as collateral, borrow more ETH, loop. Each layer earned a few hundred basis points. The base yield was small. The stack was large.

That stack is held together by trust in every layer below it. When the bridge layer fails — and bridges remain, empirically, one of the weakest surfaces in all of crypto — everything above it inherits the failure. You cannot diversify within a stack; you can only refuse to participate in it. The lending protocols priced LRT risk as if the underlying would hold peg under normal conditions. None of them priced a scenario where the collateral goes to zero because a bridge on a chain Aave doesn't touch got exploited on a Saturday.¹³

2. "Decentralized" doesn't mean "nobody decided this."

The most quoted line out of Aave's response will be the official @aave account's "Aave's contracts have not been exploited." It is factually correct and rhetorically hollow. No code was moved. Nobody breached anything. What happened is that Aave's governance process approved a 93% LTV on an asset backed by a single-validator bridge, then replaced its risk management team, then raised supply caps on that asset nine days before the bridge got exploited.¹⁰ Each decision, in isolation, looked fine. The stack of them was not.

The depositors absorbing the haircut did not participate in those governance votes. This is the part that should bother anyone who believes DeFi is supposed to be an improvement on opaque intermediation. The code is transparent. The parameters are public. The governance forum is open. None of that helps a WETH depositor who didn't know governance had been happening.

3. Architecture is destiny.

The protocols that came through this weekend without damage were not the ones with better risk models. They were the ones that never had the exposure to begin with. SparkLend reported zero rsETH exposure and credited its conservative risk posture; Fluid had tight caps; non-pooled, non-custodial venues didn't have exposure as a category.²¹ Architecture shapes what kinds of failures you can suffer. A pool that accepts cross-chain LRT collateral has a different failure mode than a swap that settles atomically between two native assets. They solve different problems and carry different tails.

This is the part I think about a lot building LeoDex. A cross-chain swap aggregator that doesn't pool user assets and doesn't accept wrapped derivatives as collateral doesn't have an Aave-style bank-run surface — not because the team is smarter, but because there's no shared book to run on. That's a design choice that looks conservative during a bull market and looks correct during a weekend like this one. It's not the right architecture for every problem. Lending genuinely needs pooled liquidity to work (and if you want lending without the wrapped-LRT collateral surface, we built a thin lending view over Chainflip's native pools — same principle: native assets, no shared book to run on). But the trade-offs of pooling aren't free, and I don't think retail depositors have been properly compensated for bearing them.

§ 08   The CodaWhat I think happens next

Aave probably survives this cleanly in the medium term. The protocol is real, the revenue is real, V4 just launched, "Aave Will Win" passed the DAO, and the SEC investigation closed in December. A $200M bad debt event on a $20B+ TVL protocol is survivable if handled correctly. The fundamentals did not break. What broke is the mental model.

Depositing into a lending pool is not "earning yield on your ETH." It is underwriting every collateral type the DAO has ever whitelisted, at every LTV the DAO has ever approved, across every bridge the DAO never audited. In practice, depositors have always been writing insurance without pricing it. The April 18 event is just the first time the premium got collected in a way that was impossible to ignore.

The TradFi version of this has a name. Bank run triggered by one counterparty's failure, concentrated through a shared exposure, amplified by the fact that depositors can exit faster than the institution can rebalance. 2008 was CDOs. 2023 was duration mismatch at Silicon Valley Bank. 2026's DeFi version is liquid restaking tokens used as collateral on overleveraged money markets. The vehicle changes. The structure doesn't.

What I want readers to take from this isn't that DeFi is broken. DeFi is doing exactly what it's supposed to do: run the code, produce the outcome, publish the data. What's broken is the gap between what retail users think they're buying and what they're actually buying. "Deposit for 3% yield" is the marketing copy. "Write uncapped insurance on every collateral type our governance forum has ever approved" is the product.

Close that gap in your own head, and everything else downstream — where you deposit, what you accept as collateral, how you think about self-custody, what architectures you trust — gets a lot clearer.

Survive > maximize. Know what you're actually underwriting when you deposit.