DeFi hack exposes lending risks and sparks run on Aave

Crypto hackers stole an estimated $290 million from DeFi lending platforms on April 18, 2026, igniting a run on the sector’s largest lender, Aave, and highlighting systemic vulnerabilities in collateral verification, insurance funds and liquidity buffers [2].

Key takeaways

• Hackers created fake rsETH tokens on KelpDAO and used them as collateral to borrow real ETH, causing a $290 million loss [2].
• Aave’s insurance fund of $80‑$100 million was far smaller than the nearly $200 million exposure, prompting a liquidity crunch and mass withdrawals [2].
• The incident underscores three core DeFi lending risks: reliance on third‑party data, inadequate insurance capital, and the role of mixers in obscuring illicit flows [2].
• Industry voices differ on the broader security outlook; some cite AI‑driven exploits as a systemic threat, while others argue defensive AI tools can mitigate risk [1].
• Regulators and supervisors are urged to address these gaps to prevent future “bank‑run” dynamics in crypto lending [2].

KelpDAO exploit and the cascade into Aave

On the day of the breach, attackers exploited a vulnerability in KelpDAO that let them mint a synthetic token called rsETH from nothing. They pledged this counterfeit token as collateral on multiple DeFi lending platforms, borrowing genuine Ethereum (ETH) against it. When KelpDAO froze rsETH markets, the lending platforms recognized the collateral as worthless, leaving lenders with valueless rsETH while the hackers transferred the stolen ETH to the mixer Tornado Cash to hide its origin [2].

The fallout centered on Aave, the sector’s biggest lending protocol. As lenders discovered that the rsETH‑backed loans were insolvent, they rushed to withdraw their ETH. Aave’s insurance fund, intended to cover such losses, held only $80‑$100 million, far short of the roughly $200 million exposure. Because withdrawals can only be fulfilled from idle liquidity, the surge quickly depleted available tokens, mirroring a classic bank run where depositors cannot access their funds [2].

Divergent views on DeFi security

The KelpDAO hack fuels a broader debate about DeFi’s security posture. Manuel Aráoz, co‑founder of OpenZeppelin, argues that advances in AI‑driven coding agents make the entire DeFi space unsafe, citing recent AI models that can locate and exploit vulnerabilities faster than human defenders [1]. He advises exiting even “blue‑chip” protocols such as Aave, MakerDAO and Compound. Critics counter that less than 10 % of DeFi incidents stem from code flaws and that AI tools are equally valuable for defense, with projects like Jack Dorsey’s Block launching AI‑based scanning initiatives to protect Bitcoin‑related software [1].

Regulatory bodies, including the Bank Policy Institute, warn that without stronger supervisory standards, the three identified risks—unreliable third‑party data, insufficient insurance capital, and the use of mixers—will continue to endanger users and could prompt further runs on DeFi platforms [2].