According to BlockBeats, on June 19, Aave experienced approximately $8.45 billion in withdrawals following an attack on KelpDAO's rsETH cross-chain bridge in April 2026, during which $292 million in rsETH was stolen. Despite the liquidity pressure, Aave's core protocol functions remained intact and the platform successfully completed one of DeFi's largest stress tests to date.
The incident exposed concentration risks, liquidity risks, and contagion risks within DeFi lending systems. Aave's multi-layered risk controls—including LTV limits, liquidation thresholds, supply caps, and governance mechanisms—functioned as designed, though observers noted that governance response speed and risk models may require optimization to handle future systemic shocks.