Aave Restores Lending After $300M Recovery Fund Ends Bridge Exploit

Aave declares full liquidity restoration on June 1, ending a six-week recovery effort

Aave Labs announced on June 1, 2026 that all lending pools had returned to normal operation, following a multi-week stabilisation effort after the April 18 rsETH bridge exploit. The decentralised finance (DeFi) protocol confirmed that depositor assets remained fully collateralised throughout the incident and that no user funds were lost. Aave's own smart contracts were not compromised; the vulnerability lay entirely in third-party bridge infrastructure operated by KelpDAO and LayerZero.

Attacker minted 116,500 forged rsETH via KelpDAO bridge to drain Aave V3 collateral pools

On April 18, 2026, an attacker exploited a vulnerability in KelpDAO's LayerZero V2 bridge by poisoning the remote procedure call (RPC) node of its single-verifier configuration. The exploit released 116,500 rsETH from the Ethereum-side bridge adapter without any corresponding token burn on the source chain. The attacker dispersed the forged tokens across seven addresses before depositing 89,567 rsETH into eight Aave V3 positions on Ethereum Core and Arbitrum, borrowing 82,650 wrapped ether (WETH) and 821 wrapped staked ether (wstETH) against that collateral. Aave's Protocol Guardian froze rsETH and wrsETH reserves across all V3 deployments by 19:00 UTC the same day and set loan-to-value ratios to zero to prevent further borrowing against the forged tokens.

DeFi United coordinates $300 million coalition across Lido, Ether.fi, Ethena, and Compound

Aave Labs launched DeFi United to coordinate the recovery effort, mobilising commitments from Lido, Ether.fi, Ethena, Compound, and several other ecosystem participants. The coalition raised approximately $300 million to backstop the compromised rsETH positions and guarantee that every dollar of user deposits remained collateralised by authentic reserves. The LayerZero OFT adapter was refilled across five tranches between May 13 and May 26, 2026, restoring a total of 116,131 rsETH to the bridge. Aave's lending markets on Ethereum Core, Arbitrum, Base, Mantle, and Linea returned to pre-exploit interest rate parameters and supply caps during the same period.

U.S. federal court order on May 8 releases $71 million in frozen recovered ETH

The recovery encountered an unexpected legal obstacle on May 1, when judgment creditors in an unrelated U.S. federal case obtained a restraining notice that froze approximately $71 million in ETH clawed back from the attacker. Aave LLC filed an emergency motion on May 4. Four days later, a judge granted a modification to the freeze, permitting the immediate transfer of the $71 million to Aave LLC's custody. Developers routed the funds directly back into the protocol's active lending pools, providing the final liquidity needed for full restoration.

Aave executes 295 parameter updates and plans automated LTV0 circuit breaker for bridge assets

Since the exploit, Aave's risk managers have executed 295 parameter changes across V3 markets, including 168 supply-cap reductions and 66 borrow-cap reductions to limit single-asset exposure. The protocol plans to implement an automated LTV0 circuit breaker that would instantly strip any asset of its borrowing power when the asset's underlying cross-chain infrastructure shows signs of compromise. Aave also plans to overhaul its listing standards to include assessment of bridge infrastructure, oracle dependencies, custodial arrangements, and operational security — criteria that financial and smart-contract risk reviews alone had not covered.

AAVE token trades at $69.94, down 8.2% in 24 hours, market cap at $1.054 billion

Aave's governance token (AAVE) traded at $69.94 at the time of publication, down 8.2% in the past 24 hours (CoinPaprika, 4 June 2026). The market capitalisation stood at $1.054 billion. AAVE has declined 12.9% over seven days (CoinPaprika, 4 June 2026).