Decentralized finance protocol Aave recently revealed that it has fully restored the liquidity of its credit pools following a $300 million cross-chain exploit.
The anatomy of the exploit
Decentralized finance (DeFi) pioneer Aave has successfully restored full liquidity to its credit pools, capping an aggressive, multi-week stabilization effort following a $300 million cross-chain exploit that threatened the protocol’s cash reserves, developers announced June 1.
Aave said in its postmortem that by mobilizing a $300 million industry-wide bailout fund and obtaining a federal emergency court order, it was able to replace drained assets, protect depositors from losses and restore normal lending and lending operations across the protocol.
The release of the post-mortem came over a month after an attacker exploited a third-party bridge operated by Kelp and Layerzero. By fabricating cross-chain messages, the hacker crafted 116,500 fake rsETH tokens and deposited them as collateral on Aave’s V3 platform.
The attacker immediately used the fake rsETH as collateral to siphon highly liquid assets, borrowing 82,650 wrapped ethereum (WETH) and 821 wrapped staked ethereum (wstETH). The sudden mass withdrawal structurally weakened Aave’s core liquidity pools, forcing risk managers to freeze affected markets to prevent a cascading run on the platform’s capital.
To fill the gap, Aave Labs helped mobilize an emergency coalition of major industry players, including Lido, Ether.fi, Ethena and Compound. Together, the group structured a $300 million recovery fund. This capital infusion effectively supported the compromised rSETH assets and ensured that every dollar of user deposits remained fully backed by authentic reserves.
The thawing of capital
However, the road to restoring liquidity hit a legal hurdle on May 1, when creditors in an unrelated federal case intercepted the recovery process. The creditors obtained a restraining order that froze approximately $71 million in ether recovered from the attacker and intended to replenish Aave’s pools.
Aave responded by filing an emergency motion in U.S. federal court on May 4, and four days later a judge approved a crucial change to the freeze, allowing the immediate transfer of the $71 million back into Aave’s direct custody. This legal breakthrough allowed developers to immediately return the funds to the protocol’s active credit pools, restoring the liquidity depth necessary for secure market transactions.
Now that capital reserves have been fully replenished and pre-operation market parameters have been restored, Aave is reviewing its risk architecture to protect its liquidity against future third-party system failures.
To prevent future attackers from converting misused tokens into liquid protocol assets, Aave developers performed 295 individual parameter updates, significantly lowering lending and supply limits for 168 separate asset pools.
Additionally, the protocol implements an automated LTV0 (loan-to-value zero) circuit breaker. In the future, if an asset’s underlying cross-chain infrastructure experiences a security breach, the system will immediately strip that asset of its collateral value. This ensures that compromised tokens can no longer be used to borrow or tap authentic liquidity from Aave’s markets.