Aave’s founder, Stani Kulechov, recently spoke at the Proof of Talk conference in Paris, defending the protocol after it faced an $8.45 billion withdrawal wave. This event followed a major exploit targeting KelpDAO’s LayerZero-powered bridge in April. Kulechov highlighted that Aave’s V3 infrastructure has withstood multiple market volatility episodes, proving its resilience during turbulent times.
The security incident, which originated from an RPC-spoofing and DDoS attack on LayerZero verifier nodes, did not directly affect Aave’s smart contracts. However, the fallout spread to the lending platform as users rushed to withdraw funds. Within 48 hours, roughly $8.45 billion in deposits left Aave, creating one of the largest liquidity shocks in decentralized finance history. To stabilize the protocol, the Aave DAO committed 25,000 ETH, and Kulechov personally contributed an additional 5,000 ETH, valued at around $8.4 million at the time.
Kulechov argued that many security incidents in DeFi stem from external dependencies rather than flaws in core protocols. He believes smart contract security has improved significantly, but risks from third-party systems remain a concern. Not everyone shares this view; LlamaRisk reported that attackers used the exploit to create worthless collateral, depositing it into Aave before withdrawing authentic wrapped Ether, leaving Aave V3 with an estimated $123.7 million in bad debt. The Bank Policy Institute added that the episode exposed weaknesses in DeFi insurance and echoed traditional bank run dynamics.
In response to these risks, Aave Labs is developing the V4 upgrade, which features a modular hub-and-spoke framework. This design aims to apply localized risk premiums and isolate problematic collateral, preventing losses from spreading across lending markets. Kulechov emphasized that public blockchain systems offer transparency, allowing open inspection of code and risk models. Additionally, Aave Labs is expanding regulated operations; subsidiaries recently received FCA approval in the UK, complementing existing MiCA authorization in the EU obtained in November 2025.