Loading article…
Aave is implementing a new risk framework for asset onboarding and bridge security following a $293 million exploit involving KelpDAO’s rsETH.
Aave is moving to implement a comprehensive risk framework across its V3, V4, and Horizon protocols to address systemic vulnerabilities exposed by the April KelpDAO exploit [1]. The incident, which involved the minting of $292 million in unbacked rsETH, triggered a liquidity shock and left the lending platform facing significant bad debt [1, 4].
Key takeaways
The proposed risk framework aims to prevent future incidents by establishing binding standards for asset listings and cross-chain infrastructure [1]. Under the new asset risk layer, protocols must provide clear legal disclosures, audit reports, and bug bounty coverage, with missing or weak documentation serving as a hard block for onboarding [1]. Furthermore, the framework mandates that bridge routes utilize at least three independent verifiers and maintain dedicated monitoring teams to ensure security [1].
To address the speed at which risks can spread, Aave is introducing automated defensive mechanisms [1]. These tools allow the protocol to freeze assets or reduce exposure automatically when warning signs appear, while recovery and parameter adjustments remain under the authority of designated Risk Stewards [1]. Additionally, the framework establishes stricter limits for chains that lack robust infrastructure or liquidity support [1].
The KelpDAO exploit caused a ripple effect across the DeFi ecosystem, leading to a liquidity crunch and the freezing of WETH reserves across multiple networks, including Ethereum, Arbitrum, and Base [2, 4]. In response, the "DeFi United" initiative was formed to restore rsETH backing, with major contributions pledged by entities such as the EtherFi Foundation, Mantle, and Aave founder Stani Kulechov [4]. As of Tuesday, the initiative reported over $300 million in commitments, though some funds remain subject to final DAO votes [3].
Aave’s risk managers are currently evaluating two scenarios for addressing the remaining bad debt, which range from approximately $123 million to $230 million depending on how losses are socialized across mainnet and layer-2 token holders [2]. While Aave has begun unfreezing some reserves, the protocol continues to work with partners to formalize recovery commitments and stabilize the lending market [2, 4].
Coverage is mostly measured — 3 of 3 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
Institutions can access Aave lending protocols directly from BitGo Bank & Trust qualified custody wallets through an integration with Narval, which provides governance and transaction verification controls.
The incident was caused by an exploit of Kelp DAO’s LayerZero-based bridge, which allowed attackers to forge messages and deposit unbacked rsETH tokens as collateral on Aave.
The framework is designed to audit existing assets on Aave V3 markets and establish more rigorous criteria for approving assets to mitigate risks from external infrastructure dependencies.
The KelpDAO exploit demonstrated how interconnectedness in DeFi can turn a single bridge vulnerability into a protocol-wide systemic risk [1, 2]. By shifting toward a continuous, multi-layered risk evaluation process, Aave seeks to reduce its exposure to the complexities of restaking and cross-chain assets [1, 2]. The ongoing recovery effort highlights the role of ecosystem collaboration in addressing bad debt, though the final resolution remains dependent on governance decisions and the successful execution of pledged contributions [3, 4].
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 4 outlets · Jun 12, 2026 · How we report