*Aave’s Wake-Up Call: Why a $230M Exploit Forced DeFi’s Biggest Lender to Change Its Rules*

Two weeks of no sleep. That’s how Aave Labs’ Linda Jeng described April 2026 after KelpDAO’s bridge got drained.

Here’s what went down: An attacker found a hole in KelpDAO’s LayerZero bridge and minted 116,500 rsETH out of thin air. Worth about $293 million. Then they walked that fake rsETH over to Aave, posted it as collateral, and borrowed $190 million in real WETH, wstETH, and stablecoins.

By the time anyone noticed, Aave was stuck with *$123.7M to $230.1M in bad debt*. And the wild part? Aave’s code worked perfectly. The problem was never the lending protocol. It was the asset they listed.

*The real issue: Aave trusted too much*

The rsETH that got exploited wasn’t a normal liquid staking token anymore. It had been wrapped 4 times before it hit Aave. But Aave still treated it like a standard LST, giving it *93% LTV / 95% LT eMode*. Basically, you could borrow $93 for every $100 of rsETH you posted.

So when the bridge broke, Aave depositors got left holding the bag. TVL dropped over $6 billion. WETH utilization sat above 99% for almost 13 days. Over 5.5 billion stablecoins fled the protocol in two weeks.

*So what’s changing?*

Aave is throwing out its old listing playbook. Before, they mostly looked at price volatility and liquidity. If the token pumped and had volume, it could get listed. Not anymore.

Going forward, every asset gets grilled on three new things:

1. *Cybersecurity* — How was the token built? Can the bridge get hacked?

2. *Architecture* — Is it wrapped 4 times with dependencies no one understands?

3. *Interoperability* — If one protocol fails, does this thing nuke everything else?

Linda Jeng said they’ll publish a formal “minimum standards” guide so other DeFi protocols can copy it. Aave also wants to stop looking at pools in isolation and start mapping how one exploit ripples across all of DeFi.

*The trade-off*

Tighter rules mean fewer YOLO listings. That could slow #AaveRevampsListingStandardsAfter$230MExploit