Aave news

Aave founder Stani Kulechov announced the proposal of a new risk framework for the protocol, developed with LlamaRisk, to prevent incidents like the $290 million KelpDAO exploit in April. The exploit saw stolen rsETH deposited into Aave as collateral to borrow WETH, creating bad debt risk. The framework introduces stricter asset reviews, bridge requirements, and automated monitoring. It sets binding risk standards for all Aave markets (V3, V4, Horizon). Assets not meeting the standard will be offboarded. The Aave community is now evaluating the proposal.

Aave founder Stani Kulechov defended the protocol's resilience after an $8.45 billion deposit run triggered by a $292 million exploit on KelpDAO's bridge in April 2026. Speaking at Proof of Talk, he highlighted Aave's ability to withstand turbulence, but critics note the survival relied on a $300 million emergency bailout, including 25,000 ETH from the Aave DAO and 5,000 ETH from Kulechov personally. The exploit originated from an RPC-spoofing attack on LayerZero nodes, not Aave's code, but left Aave with $123.7 million in bad debt. Analysts argue Kulechov's defense overlooks systemic risks, such as inadequate insurance. In response, Aave Labs plans a V4 upgrade with a hub-and-spoke system to autonomously manage risk and prevent contagion.

Aave Labs has secured FCA registration in the UK and a MiCAR license in Ireland, creating a regulated fiat-to-stablecoin on-ramp for its DeFi lending protocol. The Push layer aims to convert bank deposits into stablecoins, feeding into Aave's $14 billion TVL and $10.7 billion in outstanding loans. The expansion follows a governance restructuring under the 'Aave Will Win' framework, which routes all revenue from Aave-branded products to the DAO. This came after a governance audit criticized Labs for non-core product spending and unapproved swap fees. Push's success hinges on converting users into Aave depositors rather than just providing a ramp. Aave generates over $633 million in annualized fees and $81 million in revenue, with the new licensed infrastructure targeting the broader stablecoin market. The bear case remains that Push may not achieve protocol conversion, repeating prior expansion failures.

Aave is overhauling its listing standards after a $230 million exploit of restaked ETH (rsETH) exposed risks from cross-chain bridges. The attack, which targeted KelpDAO's use of LayerZero, allowed a single verifier to approve a forged message, minting unbacked rsETH that was then deposited into Aave as collateral. Aave's code functioned correctly, but the bridge compromise rendered the collateral worthless. In a postmortem, Aave said it will now evaluate bridge infrastructure, oracle dependencies, custodians, and operational security alongside traditional smart-contract and financial risks. It is also building automated defenses to reduce loan-to-value ratios when risk thresholds are breached. Since the exploit, Aave has executed nearly 295 parameter changes across V3 markets.

Aave Labs' UK subsidiaries, Push Labs Ltd. and Push Virtual Assets Ltd., collectively known as Push, have obtained cryptoasset registration from the UK's Financial Conduct Authority (FCA) as exchange providers under the Anti-Money Laundering regime. The registration supports Aave's plans to build regulated stablecoin on- and off-ramping infrastructure in the UK. Push offers zero-fee conversions between euros and stablecoins, providing non-custodial on- and off-ramping services between bank accounts and crypto wallets. The platform is currently available to residents of Ireland and plans to expand across Europe. The approval comes as the UK moves toward implementing comprehensive crypto regulation under the Financial Services and Markets Act, effective October 2027. Aave Labs received the registration over a month after the Aave DAO granted $25 million in stablecoins and 75,000 AAVE tokens to support the protocol's growth.

Lending protocol Aave has restored wrapped ether (WETH) loan-to-value (LTV) ratios across six major networks, reversing emergency restrictions imposed after an April exploit that caused over $230 million in tokens to be stolen. The move comes after attackers exploited a bridge tied to Kelp DAO’s rsETH, minting unbacked tokens used to drain ETH from Aave. Pre-incident LTVs have been restored to normal levels, including 80.5% on Ethereum Core and 84% on Ethereum Prime. About 112,103 unbacked rsETH was created in the exploit, with roughly 106,993 recovered through liquidations and coordinated actions. A residual shortfall of about 5,200 rsETH is expected to be covered by the industry coalition DeFi United. The restoration signals that Aave believes the immediate systemic risk has been contained, although legal disputes over frozen assets and liability questions remain unresolved.

Aave has restored loan-to-value ratios for wrapped Ether (WETH) across all affected networks, allowing users to borrow against WETH again. This completes Phase II of the rsETH recovery plan following the Kelp DAO exploit on April 18, which caused around $195 million in bad debt on Aave. The temporary freeze was lifted after progress in recovery, including restoring rsETH's backing and allowing withdrawals. The Kelp exploit, linked to North Korean state-backed hackers, involved stolen rsETH tokens used as collateral to borrow WETH. Aave's total value locked dropped from $23.5 billion in March to about $14.8 billion. However, Ether utilization has fallen below 90% and borrowing rates are at 1.9%, potentially attracting leveraged yield strategies. Separately, Kelp DAO is sunsetting rsETH bridging on several networks after June 15, citing security. Recovery of funds after the deadline will incur a fee of 100 USDC. Kelp has also migrated rsETH to Chainlink's oracle platform, blaming LayerZero's infrastructure for the attack.

A New York judge has delayed a decision on Aave's emergency motion to unfreeze $71 million in ETH tied to the Kelp DAO hack, requesting additional information from both sides ahead of a new hearing on June 5. Judge Margaret M. Garnett ruled that Aave's filing did not adequately demonstrate how compounding losses could occur if the restraining notice remains. The court ordered supplemental briefings on six points, including the legal status of stolen assets and creditor priority. Aave sought to use the frozen funds, originally frozen by Arbitrum, to aid recovery from the $293 million hack. Meanwhile, Kelp DAO and Aave have taken steps to restore rsETH backing by burning the hacker's tokens and using a multisig wallet to restore lost funds over two weeks.

Kelp DAO and Aave announced they will resume rsETH-related operations in the coming days following the $292 million exploit last month. Starting Tuesday, 117,132 rsETH will be progressively refilled into the LayerZero OFT adapter over two weeks, with withdrawals expected to unpause within 24 hours after the first tranche. Kelp completed a security update on LayerZero bridging configurations and is migrating to Chainlink's CCIP. Aave confirmed the first recovery steps are complete, including burning the exploiter's rsETH on Arbitrum. The April 18 attack, attributed to North Korea's Lazarus Group, led to $190 million in bad debt for Aave, triggering the DeFi United restitution initiative that raised over $300 million. A legal dispute over frozen funds on Arbitrum was resolved when a court allowed the transfer of $72 million in ETH to Aave, though Aave cannot sell or move the funds without further approval. LayerZero issued a public apology for allowing insecure 1-of-1 DVN configurations that enabled the exploit.

DeFi lender Aave has launched a binding Arbitrum governance vote to transfer 30,765 ETH (worth approximately $71 million) from a frozen address to an Aave LLC-controlled wallet, following a court order by Judge Margaret Garnett. The funds were immobilized by Arbitrum’s Security Council after last month’s Kelp DAO hack, which blockchain forensics firms have attributed to North Korea’s Lazarus Group. If approved, the assets would remain subject to strict legal restrictions and cannot be freely used or transferred without court permission. The dispute has drawn in terrorism judgment creditors who hold roughly $877 million in unpaid U.S. awards against North Korea, arguing the funds could potentially satisfy those judgments if linked to the state. Aave contends the ether belongs to DeFi users harmed in the exploit, not the attackers. Separately, the creditors have also sued privacy protocol Railgun DAO over alleged North Korea-linked transactions. Voting on the proposal is set to begin May 15.