Aave Proposes New Risk Framework After $292 Million KelpDAO Exploit

Aave founder Stani Kulechov announced Tuesday that the protocol has proposed a new risk framework designed to address cross-chain vulnerabilities exposed by the April KelpDAO incident. The framework, prepared by LlamaRisk and now open for governance review, covers asset risk, bridging risk, chain risk, and automated risk management tools across Aave V3, V4, and Aave Horizon.

The proposal was triggered after a LayerZero-powered bridge used by KelpDAO was exploited for 116,500 rsETH tokens valued at approximately $292 million in April. Following the attack, a significant portion of stolen rsETH was deposited into Aave V3 as collateral to borrow large amounts of WETH, exposing the lending protocol to downstream bridge failures. If approved, the framework would establish continuous risk review at asset onboarding, during quarterly due diligence, after material infrastructure changes, and during parameter decisions. Kulechov stated that assets failing to meet the new standard will be offboarded from Aave over the coming weeks.