BlockBeats News, June 8th. In April this year, KelpDAO, a LayerZero-based cross-chain bridge, suffered a $292 million attack, triggering an $8.45 billion deposit run on the DeFi lending protocol Aave within 48 hours. Facing external scrutiny of the protocol's risk control capabilities, Aave's founder and CEO Stani Kulechov stated that this event precisely demonstrated Aave's "resilience."

Speaking at the Paris Proof of Talk conference, Kulechov mentioned that Aave V3 has withstood multiple market cycles and remained stable even during extreme market conditions. He believed that recent DeFi security incidents mainly originated from third-party infrastructure rather than smart contract vulnerabilities in the protocol itself.

However, according to the risk analysis firm LlamaRisk, the attacker exploited the KelpDAO vulnerability to mint valueless collateral and deposited it into Aave to then withdraw real wETH, resulting in approximately $1.237 billion in defaults for Aave V3. To address the crisis, the Aave DAO swiftly transferred 25,000 ETH, with Kulechov himself injecting an additional 5,000 ETH, amounting to a total rescue package of around $300 million.

To address the revealed systemic risks, Aave is planning to restructure its risk management framework through the V4 upgrade. The new version will adopt a modular "Hub-and-Spoke" design, replacing the traditional money pool model, allowing the protocol to implement separate risk pricing for different collaterals, freeze specific collateral assets before risk propagation, and reduce the likelihood of cascading runs caused by cross-chain bridge failures.