Aave overhauls listing standards after $230 million rsETH exploit exposed bridge risks

Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Aave overhauls listing standards after $230 million rsETH exploit exposed bridge risks An official postmortem traced the exploit to a LayerZero bridge verification failure and outlined a sweeping overhaul of Aave s asset-listing standards as DeFi risks shift beyond smart contract bugs. By Sam Reynolds | Edited by Shaurya Malwa Updated Jun 1, 2026, 8:34 a.m. Published Jun 1, 2026, 5:04 a.m. 3 min read Make preferred on What to know : Aave said the record 2026 rsETH exploit stemmed from a failure in KelpDAO’s LayerZero-powered bridge, not a bug in Aave’s own smart contracts, prompting a sweeping review of all V3 assets and listing standards. In its postmortem, Aave detailed how attackers abused a single LayerZero verifier to forge a cross-chain message and mint 116,500 unbacked rsETH on Ethereum, exposing hidden risks in bridges and other off-chain infrastructure. Aave plans to overhaul its risk framework to scrutinize bridges, oracles, custodians and operational security, add automated defenses that can instantly strip collateral of borrowing power, and has already made hundreds of parameter changes to curb exposure. The most expensive DeFi attack of 2026 began with KelpDAO s restaked ether (rsETH) bridge, not a bug in Aave s code. That, the lending protocol argues in an official postmortem published this week , is precisely why the industry needs to rethink how it measures risk.