The head of Aave responds to criticism after a historic liquidity crisis

In April 2026, a flaw in KelpDAO’s LayerZero bridge triggered withdrawals of $8.45 billion on Aave in less than 48 hours, the largest banking panic in DeFi history. Stani Kulechov, founder of Aave Labs, presented the episode as proof of the protocol’s robustness at the Proof of Talk in Paris. However, the facts paint a much less flattering picture.

Kulechov on stage, resilience, really?

At the Proof of Talk event held in Paris last week, Stani Kulechov drew a parallel between decentralized finance and traditional banks, to the advantage of the former. 

“Aave showed great resilience even during very turbulent periods“, he stated, without dwelling on the exact conditions of the protocol’s survival.

However, independent data tell a different story. According to analysis firm LlamaRisk, attackers exploited the flaw to create worthless collateral, deposited it on Aave, then siphoned genuine wETH, leaving the protocol with an unrecoverable debt estimated at $123.7 million. 

The subsequent bailout was far from automatic: 25,000 ETH mobilized by the Aave DAO, 5,000 ETH personally injected by Kulechov. In total, $300 million coordinated urgently by humans, not by code.

Kulechov nevertheless denied any responsibility of the core protocol. “Smart contract issues in DeFi protocols are generally very rare, if existent at all. It’s more about third-party dependencies“, he specified. 

Technically, the attack did indeed start with an RPC address spoofing targeting LayerZero verification nodes, not a flaw within Aave. But for analysts from the Bank Policy Institute, this framing obscures the essential fact: DeFi remains structurally vulnerable to banking panics, to the detriment of its users.

Aave V4, redesign the architecture to compartmentalize risk

In response to these shortcomings, Kulechov announced a profound redesign of risk management in the upcoming V4 upgrade. The main goal: prevent a future crypto bridge exploit from contaminating the protocol’s entire reserves.

The chosen principle is a modular star system. Concretely, this system would replace the current pooled architecture with isolated modules, capable of charging localized risk premiums and freezing specific collateral lines before contagion reaches the main reserves. 

With a fully auditable and public system, anyone can examine the code and perform different types of risk analyses.

Moreover, the issue of insurance remains open. Analysts from the Bank Policy Institute noted that Aave’s coverage proved insufficient given the scale of the crisis, a point that V4 does not address directly in the details communicated so far.

Ultimately, the April 2026 episode illustrates the persistent tension between DeFi’s resilience narrative and its real vulnerabilities. The run on Aave, the emergency human intervention, the nine-figure bad debt: these elements collectively remind us that decentralized protocols are not yet immune to classical banking panics. 

The V4 promises a more robust architecture, but it’s its actual deployment and resistance to the next stress test that will settle the question. Meanwhile, institutional DeFi continues to watch. Not yet convinced.