Aave:
a clean core-contract record for years, sitting on a real, recurring third-party collateral risk.
We tore apart Aave, the largest crypto lending and borrowing protocol by total value locked, opening a new series with a scorecard adapted specifically for this category: Security & Smart Contract Risk, Liquidity & Market Depth, Decentralization & Governance, Asset & Collateral Support, User Experience & Interface, Rates & Value for Money, and Advanced Features & Extras. From a genuinely long, clean core-smart-contract record, no confirmed direct hack of Aave's own contracts found since its 2020 relaunch, extensive named audits, roughly a third of all DeFi lending TVL, and a genuinely sophisticated, disclosed feature set (Flash Loans, eMode, Isolation Mode, the GHO stablecoin, and V4's new Hub & Spoke architecture), to a real, recurring pattern worth centering directly: third-party bridge and collateral risk repeatedly materializing on Aave's own markets, from a 2022 Harmony bridge hack that forced a precautionary suspension, to confirmed bad debt tied to the 2022 Mango Markets exploit, to a April 2026 exploit on a bridge used by a listed collateral asset that triggered an $8.45 billion, 48-hour panic withdrawal and a $300 million emergency response, the largest liquidity crisis we've documented in this entire project; and landed on a score the marketing page won't show you.
Our take, up front: Aave is the largest crypto lending and borrowing protocol, opening a new series with a scorecard adapted specifically for this category. Real, genuinely long, clean core-smart-contract record: despite dedicated searching, we found no confirmed direct hack of Aave's own contracts since its relaunch from ETHLend into a liquidity-pool protocol in early 2020. Real, genuinely extensive, long-standing audit relationships with named firms including Certora (a formal-verification partnership dating to January 2020), OpenZeppelin, PeckShield, and Trail of Bits. Real, genuinely dominant scale: roughly a third of all DeFi lending TVL, and $73.36 million in 30-day V3 protocol fees as of one detailed May 2026 source. Real, genuinely sophisticated, disclosed feature set: Flash Loans (a primitive Aave itself pioneered), eMode for capital-efficient correlated-asset borrowing, Isolation Mode for safely listing riskier assets with capped exposure, the GHO overcollateralized stablecoin with a savings layer (sGHO), and V4's newly-launched Hub & Spoke architecture introducing health-targeted liquidations that close only what's needed to restore safety, rather than an entire position. What we can't set aside: a real, well-documented, recurring pattern of third-party risk materializing directly on Aave's own markets. In 2022, a hack of the Harmony bridge forced Aave to precautionarily suspend activity on that network; separately, the 2022 Mango Markets oracle-manipulation exploit crashed CRV's price and left Aave with confirmed bad debt that had to be cleared. On March 10, 2026, an internal CAPO oracle misconfiguration, not a hack, triggered roughly $27 million in forced liquidations across 34 accounts; Aave confirmed no bad debt resulted and fully reimbursed affected users. Then in April 2026, an exploit on a third-party bridge underlying a listed collateral asset allowed an attacker to mint unbacked tokens and borrow real assets against them; the resulting loss of confidence triggered an $8.45 billion withdrawal from Aave within 48 hours, described by multiple sources as the largest liquidity crisis in DeFi history, requiring a $300 million emergency response and a complete, disclosed overhaul of Aave's risk framework. We weighted all of it below.
Real, genuinely long, clean core-smart-contract record: despite dedicated searching, we found no confirmed direct hack of Aave's own contracts since its relaunch into a liquidity-pool protocol in early 2020. Real, genuinely extensive, long-standing named audits (Certora since January 2020, OpenZeppelin, PeckShield, Trail of Bits). What we can't set aside: a real, well-documented, recurring pattern of third-party risk materializing directly on Aave's own markets. A 2022 Harmony bridge hack forced a precautionary suspension of Aave activity on that network. The 2022 Mango Markets oracle-manipulation exploit crashed CRV's price and left Aave with confirmed bad debt that had to be cleared. On March 10, 2026, an internal CAPO oracle misconfiguration triggered ~$27 million in forced liquidations across 34 accounts; Aave confirmed no bad debt and fully reimbursed affected users. In April 2026, an exploit on a third-party bridge underlying a listed collateral asset allowed unbacked tokens to be minted and borrowed against, triggering an $8.45 billion, 48-hour panic withdrawal, described by multiple sources as the largest liquidity crisis in DeFi history, and requiring a $300 million emergency response.
Pros
- No confirmed direct hack of Aave's own contracts found in our research
- Extensive, long-standing audits from named firms; a new 4-layer risk framework announced June 2026
- March 2026 oracle incident: no bad debt, full reimbursement, immediate remediation
Cons
- Apr 2026: $292M third-party bridge exploit triggered an $8.45B panic withdrawal and $300M bailout
- 2022: confirmed bad debt from the Mango Markets-linked CRV crash
- A recurring pattern (Harmony 2022 → KelpDAO 2026) of bridge/collateral risk hitting Aave's markets
Real, genuinely dominant scale: roughly a third of all DeFi lending TVL, and $73.36 million in 30-day V3 protocol fees per one detailed May 2026 source. Real, disclosed, significant TVL decline: from a peak near $30.25-45 billion (sources vary on the exact peak and month) in late 2025 to roughly $14.49 billion by May 2026, reflecting both a broader crypto downturn and the April 2026 exploit fallout combined.
Pros
- Roughly a third of all DeFi lending TVL; the category's clear liquidity leader
- $73.36M in 30-day V3 fees, a healthy, disclosed revenue signal
Cons
- TVL fell more than 50% over 6 months amid a combination of market conditions and exploit fallout
- Sources disagree on the exact peak TVL figure and month
Real, disclosed, functioning on-chain governance via the AAVE token (16 million max supply, 94.87% circulating). Real, disclosed, publicly known leadership (Stani Kulechov, since the ETHLend era), a genuine positive relative to several anonymous-team platforms we've reviewed elsewhere. Real, honest, disclosed trade-off: DAO decision latency can slow emergency parameter changes, and at least one detailed source notes real governance friction with core development teams in early 2026.
Pros
- Functioning on-chain AAVE governance; publicly known founder and leadership
- Disclosed Safety Module / evolving "Umbrella" backstop funded by staked AAVE
Cons
- DAO decision latency can slow emergency parameter changes, per at least one source
- Real governance friction with core development teams noted in early 2026
Real, disclosed extremely broad reach: 21+ active V3 chains, hundreds of supported collateral assets across Core and Prime markets. Real, genuinely sophisticated risk-segmented listing system: eMode for capital-efficient correlated-asset borrowing, and Isolation Mode for safely listing riskier assets under a capped debt ceiling.
Pros
- 21+ active chains under V3, each with independent reserves and risk configurations
- eMode and Isolation Mode allow both efficiency and safe, capped-risk listing of newer assets
Cons
- Broader asset support also means a broader collateral-quality attack surface, as the Apr 2026 incident showed
Real, disclosed continuous gas optimizations under V3 and V4, and Portal for cross-chain liquidity movement. Real, honest, recurring caveat across nearly every source we found: safe use genuinely depends on the user's own continuous tracking of health factor and liquidation risk signals.
Pros
- Continuous gas optimizations; Portal for cross-chain liquidity movement
Cons
- Safe use genuinely requires active, ongoing health-factor monitoring by the user
Real, disclosed variable-rate, two-slope utilization model; genuinely competitive, transparently disclosed USDC borrow rates (2-8% typical, spiking above 15% under high demand). Real, disclosed GHO stablecoin offering more predictable, governance-set borrowing costs as an alternative. Real, honest, disclosed value-accrual gap found in a detailed technical source: despite $550M+ in annualized protocol fees, only roughly $74M accrues to the DAO treasury.
Pros
- Transparent, disclosed two-slope variable-rate model; competitive typical USDC rates
- GHO offers a more predictable, governance-set borrowing cost alternative
Cons
- Only a fraction of total generated fees (~$74M of $550M+) accrues to the treasury, per one detailed source
- Rates can spike sharply (above 15%) during high-demand periods
Real, genuinely extensive, technically sophisticated feature set: Flash Loans (a primitive Aave itself pioneered), eMode, Isolation Mode, the GHO stablecoin with its sGHO savings layer, and V4's newly-launched Hub & Spoke architecture introducing health-targeted liquidations that close only what's needed to restore safety, rather than an entire position.
Pros
- Flash Loans, eMode, Isolation Mode, GHO/sGHO, and V4's health-targeted liquidations
- First-mover on several of these primitives, widely adopted across DeFi since
Cons
- Genuine sophistication also means a genuinely larger surface area to secure and understand
Access only through Aave's official app, and give real weight to which specific collateral assets you supply against.
Given that the most severe recent incident originated from a bridged collateral asset rather than Aave's own code, actively check which underlying bridge or wrapping mechanism backs any newer collateral asset before depositing or borrowing against it, and monitor your Health Factor directly rather than assuming a comfortable buffer will hold during a fast-moving event.
The category's dominant protocol, with a genuinely serious, recurring blind spot at its edges.
Aave deserves real credit for something genuinely rare at its scale: years of operation without a confirmed direct hack of its own smart contracts, an achievement that gets harder, not easier, as more money and more integrations accumulate on top of a protocol. Its feature engineering is genuinely best-in-class, and Flash Loans alone reshaped what people thought DeFi could do. But we don't think "our own code has never been hacked" is the complete security story for a lending protocol specifically, because a lending protocol's core function is accepting other people's assets as collateral. The Harmony suspension, the Mango-linked bad debt, and especially the April 2026 crisis all trace back to the same structural pattern: something outside Aave's own contracts went wrong, and it became Aave's problem anyway, at a scale, in the April 2026 case, larger than almost anything else we've documented in this entire project. A new four-layer risk framework is a real, substantive response; whether it holds is something we'll be watching closely in future updates.
The scorecard above is deliberately general. Whether Aave is right for you depends heavily on which of these you already are.
The user who wants the deepest lending liquidity available and is comfortable sticking to established, blue-chip collateral like ETH, WBTC, or major stablecoins
This is exactly where Aave's genuine scale and years of core-contract reliability concentrate most heavily.
The advanced user who wants eMode's capital efficiency on correlated assets or GHO's governance-set borrowing rate
These are genuinely distinctive, well-engineered tools most competing lending protocols don't offer as cleanly.
The borrower who actively vets which specific bridge or wrapping mechanism backs any newer collateral asset before depositing
Given exactly what triggered the April 2026 crisis, this specific habit genuinely matters here more than on most lending protocols.
Anyone who wants a lending protocol with zero exposure to third-party bridge or oracle risk
Aave's own broad, multi-chain, multi-asset ambition is precisely what creates this recurring exposure; a smaller, narrower-scope protocol may carry less of it.
The scorecard covers the headline judgment calls. These four tables cover the specifics we didn't want to bury in prose; every third-party incident timelined precisely, the multi-year Egorov/CRV saga explained, GHO's mechanics, and the start of a new lending-protocol comparison table.
Four incidents, one recurring pattern
| Date | What happened | Aave's own contracts breached? | Outcome |
|---|---|---|---|
| 2022 | Harmony bridge hacked; Aave had a market deployed on that network | No | Aave precautionarily suspended activity on Harmony |
| ~Jan 2023 | Mango Markets oracle-manipulation exploit crashed CRV's price | No | Confirmed bad debt on Aave (2.7M CRV) was later cleared |
| Mar 10, 2026 | Internal CAPO oracle misconfiguration mispriced wstETH by ~2.85% | No (internal config, not a hack) | ~$27M in liquidations; no bad debt; full reimbursement |
| Apr 2026 | Exploit on a third-party bridge underlying a listed collateral asset | No | $292M exploited; $8.45B panic withdrawal in 48 hours; $300M emergency response |
In every one of these four events, the vulnerability originated outside Aave's own smart contracts, in a bridge, an oracle input, or a third-party exploit's downstream effects. We think that distinction is real and matters, but we don't think it fully absolves the protocol either: accepting a broad range of bridged and correlated collateral is a core, deliberate design choice, and this recurring pattern is a direct, foreseeable consequence of that choice.
The multi-year Egorov/CRV saga
| Period | What happened |
|---|---|
| 2022-2023 | Curve founder Michael Egorov's CRV-backed loans, at times over 30% of CRV's total supply, repeatedly approached liquidation thresholds on Aave amid CRV price volatility |
| Mar 2023 | Aave's risk manager Gauntlet proposed freezing CRV markets and zeroing its loan-to-value ratio to prevent a concentrated liquidation from generating bad debt |
| 2023 | Egorov proactively sold and OTC-traded CRV, and repaid debt across multiple protocols including Aave, to reduce liquidation risk |
| 2026 | Egorov was ultimately liquidated for $140M across multiple protocols during a sharp CRV price decline |
We're presenting this as a distinct pattern from the four incidents above: it's a concentrated whale-collateral risk that Aave's own risk-management apparatus (Gauntlet, and later Chaos Labs) had to actively and repeatedly manage, rather than a single discrete event.
How GHO works
| GHO | |
|---|---|
| Launched | July 2023, on Ethereum; since expanded to Arbitrum, Base, and Avalanche |
| How it's minted | Directly by users, who deposit supported collateral (ETH, WBTC, stETH, and others) into Aave V3 markets |
| Interest rate | Set by Aave Governance, typically more predictable than variable-rate stablecoin borrowing elsewhere |
| Savings layer | sGHO lets holders earn yield funded by protocol revenue; over 54% of circulating GHO was staked as sGHO by late 2025 |
GHO's market cap stood at roughly $583.61 million as of one May 2026 source, trading within tight peg bounds.
Lending protocols, side by side (series begins)
| Aave | |
|---|---|
| Confirmed core-contract exploit | None found in our research |
| Third-party/edge incidents | Four, tracing to bridges, oracles, and a third-party exploit's downstream effects |
| TVL share of category | Roughly one-third of all DeFi lending TVL |
| Distinctive model | Multi-network V3 markets; V4 Hub & Spoke; native GHO stablecoin |
This is the first entry in a new lending & borrowing protocol series; this table will grow as we review Compound, MakerDAO/Sky, Morpho, and others under the same adapted scorecard.
We don't just want to hand you our number; we want to show you how it sits next to what other review desks and comparison sites have published. Aave's scale and history mean genuinely deep, specific independent coverage exists, giving us a strong comparison set here.
Our score lands moderately below the aggregated industry average; most general reviews we found were published before, or without full weight given to, the April 2026 crisis, and tend to credit the clean core-contract record without weighting the recurring third-party pattern as heavily as our methodology does.
| Source | Score | Type |
|---|
Scores compiled by our editorial team from publicly available reviews as of August 2026. "Editorial estimate" means the outlet didn't publish a single numeric score, so we converted their published verdict and sentiment into a comparable 100-point figure. Verify current figures directly with each source before citing them elsewhere.
We found no confirmed direct hack of Aave's own smart contracts since its 2020 relaunch. However, Aave has repeatedly been affected by third-party incidents: a 2022 Harmony bridge hack, 2022 Mango Markets-linked bad debt, a March 2026 internal oracle misconfiguration, and an April 2026 exploit on a bridge underlying a listed collateral asset.
An exploit on a third-party bridge underlying a listed collateral asset allowed an attacker to mint unbacked tokens and borrow real assets against them on Aave. The resulting loss of confidence triggered an $8.45 billion withdrawal from Aave within 48 hours, described by multiple sources as the largest liquidity crisis in DeFi history, requiring a $300 million emergency response and a new four-layer risk framework.
An internal misconfiguration in Aave's CAPO (Capped Asset Price Oracle) system caused the wstETH/stETH exchange rate to be underpriced by about 2.85%, triggering roughly $27 million in liquidations across 34 accounts. Aave confirmed no bad debt resulted and fully reimbursed affected users.
GHO is Aave's own overcollateralized stablecoin, launched July 2023, minted directly by users who deposit supported collateral into Aave V3 markets. Its interest rate is set by Aave Governance, and its savings layer, sGHO, lets holders earn yield funded by protocol revenue.
eMode (Efficiency Mode) allows higher loan-to-value ratios and lower rates when borrowing correlated assets, like one stablecoin against another. Isolation Mode lets the DAO list riskier, newer assets safely, under a capped debt ceiling that limits systemic exposure if that specific asset fails.
Rates are variable and change continuously based on utilization. Typical USDC borrowing rates range from 2-8% in normal conditions but can spike above 15% during high demand. Flash loans carry a separate, disclosed fee of 0.05% (roughly $5 per $10,000 borrowed), stable since V3 launch.
Curve Finance founder Michael Egorov repeatedly used large CRV holdings, at times over 30% of total supply, as collateral for loans on Aave and other protocols between 2022 and 2026. This concentrated position required active risk management by Aave's own risk managers on multiple occasions, and Egorov was ultimately liquidated for $140 million across multiple protocols in 2026.
Yes, AAVE, with a 16 million max supply and roughly 94.87% currently circulating. AAVE holders govern the protocol's risk parameters and treasury, and staked AAVE (stkAAVE) backs the Safety Module, an evolving backstop for shortfall events.
More Reviews
Ledn – Crypto Lending & Borrowing Review
Score: 75/100. Highest CeFi score in this series: 10 straight PoR attestations, explicit no-re-lending pledge, never lost customer funds.
Read More
Compound – Crypto Lending & Borrowing Review
Score: 63.25/100. Pioneer whose 2021 self-inflicted $161.7M COMP bug remains its scar, though its caution spared it in Apr 2026.
Read More
CoinRabbit – Crypto Lending & Borrowing Review
Score: 50.5/100. Fast, no-KYC lending with a great product, but no named founder, no PoR, and vague licensing behind it.
Read More
Kamino – Crypto Lending & Borrowing Review
Score: 72.25/100. Survived two 2026 stress events with zero bad debt, per a Q2 investor report, not just its own marketing.
Read More