Summary
Aave V3 is the third major iteration of the Aave decentralized lending protocol, one of the largest in DeFi with over $14 billion in total value locked across 21 chains as of May 2026. The protocol's core smart contracts have not been directly exploited; however, in April 2026, a $292 million bridge exploit targeting integrated asset KelpDAO's rsETH generated significant bad debt on Aave V3 markets, an event flagged by on-chain investigator ZachXBT. The protocol demonstrated institutional resilience by coordinating a cross-industry recovery fund (DeFi United) that ultimately raised over $327 million, with full rsETH operations restored by May 25, 2026.
Connected Entities
1 entities- + 8 more
Timeline(18 events)
2022-03-16
Aave V3 officially launched on Avalanche, Polygon, Arbitrum, Optimism, Fantom, and Harmony.
2023-01-27
Aave V3 deployed on Ethereum mainnet.
2023-07-15
GHO, Aave's native decentralized stablecoin, launched on Ethereum mainnet.
2023-11-04
Aave receives bug bounty disclosure of critical vulnerability affecting V2 pools. Guardian pauses V2 Ethereum and freezes assets on V2/V3 across multiple chains. No funds lost.
2023-12-01
All Aave V2/V3 markets resume full normal operations following November 2023 security incident.
2024-06-20
Certora completes formal verification and security audit of Aave V3 Risk-Steward contracts.
2024-08-28
ParaSwapRepayAdapter periphery contract exploited for approximately $56,000. Core Aave V3 contracts unaffected.
2025-01-29
Oxor completes security audit of Aave V3.3.0 smart contracts.
2025-06-01
Aave Umbrella safety module launches on Ethereum with support for aUSDC, aUSDT, aWETH, and GHO staking.
2025-12-16
SEC closes four-year investigation into Aave with no enforcement action.
2026-04-18
KelpDAO rsETH LayerZero bridge exploit: attacker mints 116,500 unbacked rsETH and deposits 89,567 rsETH as collateral on Aave V3, borrowing ~$191 million. ZachXBT flags the exploit publicly.
2026-04-18
Aave Protocol Guardian freezes rsETH/wrsETH reserves across all 11 affected V3 deployments within hours of the exploit.
2026-04-19
Aave TVL falls approximately $6.6 billion. AAVE token declines 10-13%.
2026-04-20
Aave service providers publish rsETH Incident Report, estimating bad debt between $123.7 million and $230.1 million.
2026-04-23
Aave launches DeFi United coalition to raise funds covering bad debt. Aave DAO and Mantle pledge combined 55,000 ETH.
2026-04-25
DeFi United raises $160 million, representing approximately 80% of estimated bad debt coverage needed.
2026-05-18
Aave restores normal WETH loan-to-value ratios across six V3 networks as recovery exceeds 95%.
2026-05-25
Aave and Kelp DAO announce full restoration of rsETH operations. DeFi United total raised surpasses $327 million. Approximately 106,993 of 112,103 unbacked rsETH recovered or offset.
Decision Log
- hash: ANLx5dR5UGK4zxV7eUDbMQKL5iRxXRYxJNFArEoMhCcD
- hash: 8j9DZEtERR4c5mQh2cwU3s9EYxUPpAT6zJwReC9fQbCt
- hash: zyhqDXVECDiJciEW2jn29kRFEzkYTRzn8egvHRTa6nT
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:12 AM
last updated: 6/4/2026, 3:24:23 AM
avoid.net — verified advice for a post-truth world