Six years of surviving the thing that breaks lenders
Aave has run the largest lending book in DeFi since 2020, through every liquidation cascade the market has produced, with no exploit of its own contracts. Its risk governance adjusts parameters before problems arrive rather than after, and every position, threshold and unit of bad debt is visible on-chain. That is the reference standard, and it was earned.
April 2026
An attacker deposited rsETH minted out of nothing in the Kelp bridge exploit, borrowed real assets against it on v3 and v4, and left Aave carrying between $177m and $236m in bad debt. TVL fell about $6.6bn in the days that followed. The contracts did exactly what they were told; what they were told included accepting a wrapped asset whose backing could be fabricated upstream. A shared pool means one listing decision reaches every depositor.
The earlier entry
November 2022 left roughly $1.6m of bad debt after a CRV short squeeze, covered by the treasury. Both events are publicly recorded, which is itself part of the case for using an on-chain market.
Still the default
Deepest liquidity, published algorithmic rates, over-collateralised positions and governance that publishes its reasoning. For most borrowers it remains the right venue — with the 2026 lesson attached.