llamarisk
LlamaRisk is a DeFi risk service provider founded in 2021 to assess collateral for Curve DAO. It joined Aave as a second risk provider in 2024 and has held Aave's risk-management controls, together with Aave Labs, since Chaos Labs left in April 2026. It also works with Ethena, Chainlink and Curve.
Our read
LlamaRisk is the most transparent of the Aave-era risk firms: its onboarding framework and reasoning are public on GitHub. It also took over Aave's controls ten days before the largest bad-debt event in Aave's history, on collateral settings it had helped maintain. Anyone relying on Aave now relies on how fast this small team, not a large vendor, reacts.
Key facts
- Aave risk controls
- Risk Steward and Risk Council multisigs (2/2 with Aave Labs) since April 2026
- Apr 2026 · Aave Governance ↗
What LlamaRisk does
LlamaRisk started in 2021 inside the Curve ecosystem because, in its words, integrations were happening faster than DAO members could assess them. Its early clients were Curve and Prisma Finance. When it applied to Aave in March 2024 it had five full-time staff and about a dozen analysts across America, Europe and Asia, and asked for $250,000 for six months, mostly for assessing collateral for the GHO stablecoin.
Its role grew in two steps. First it worked beside Chaos Labs on asset listings. Then, when Chaos Labs announced its exit, LlamaRisk said on 7 April 2026 that it would absorb every departing function: caps, rate curves, liquidation parameters, oracle design and new-asset reviews for Aave V3 and V4. It also said it would need 'a substantially larger budget' and would replace the previous closed-source tooling with protocol-owned infrastructure on Chainlink's runtime environment. Its site now lists Aave, Aave Horizon, Ethena, Chainlink and Curve as clients, plus a product suite called LlamaGuard.
What sets it apart is that the method is public. Its Aave V3 framework on GitHub walks through an asset's fundamentals, then market, technological and counterparty risk, and only then the parameters it proposes. A reader can check a listing against those steps before the vote, which is not possible with a closed simulation model. It also covers legal and regulatory questions, which most risk firms leave to the issuer.
LlamaRisk and the Aave rsETH incident
On 18 April 2026 an attacker exploited the LayerZero route used by bridged Kelp rsETH, minted unbacked rsETH and posted 89,567 of it as collateral on Aave, borrowing about $193 million. rsETH and wrsETH were accepted at up to 95% loan-to-value on eleven Aave deployments while the bridged copies depended on a single verifier.
| When | What happened |
|---|---|
| 18 Apr, within ~90 min | rsETH and wrsETH frozen on all Aave V3 deployments; WETH rate curves flattened |
| 20 Apr | Service providers, LlamaRisk among them, publish the incident report with bad-debt scenarios |
| 24 Apr | Funding plan: 14,570 ETH committed by EtherFi, Lido, Ethena and others; up to 30,000 ETH Mantle facility; 25,000 ETH requested from the Aave treasury |
| 6 May | Attacker positions liquidated; 106,993 rsETH recovered across Aave and Compound |
Under the report's uniform-loss scenario, bad debt on Aave's Ethereum WETH reserve alone would have been about $91.8 million, with roughly $26.8 million more on Mantle, Arbitrum and Base. We record the event against LlamaRisk because it held the parameter controls that day; the collateral settings themselves had been set while both LlamaRisk and Chaos Labs served Aave.
Incident log
1 entry · $91.8M lost in total · repaid, confirmed: 0 of 1 where user funds were at stake
Exploit$91.8M
Kelp rsETH bridge exploit leaves bad debt on Aave
Unbacked rsETH minted through a LayerZero bridge exploit was used as collateral on Aave to borrow about $193M. The figure is bad debt modelled for the Ethereum Core WETH reserve alone under the incident report's uniform-loss scenario; other deployments add about $26.8M.
Repaid — company's word only106,993 rsETH was recovered by liquidating the attacker on 6 May 2026, and the DeFi United coalition, with Aave DAO funds, committed ETH to cover the remaining ~5,211 rsETH. The WETH-unfreeze proposal made restoration contingent on those funds being deployed; we found no final accounting confirming every market was made whole.
In our ratings
This page is the record. The scores sit on the review cards, next to the evidence and the weights they came from.
Compare LlamaRisk with
Chaos LabsDeFi risk manager · 2021 · United StatesChaos Labs builds risk oracles that update DeFi lending parameters automatically. It was Aave's main risk manager from 2022 until it left in April 2026.
GauntletDeFi risk manager · 2018 · United StatesGauntlet is a New York DeFi risk firm that sets Compound's lending parameters and curates yield vaults on Morpho, Kamino and Drift. Founded in 2018.
Block AnaliticaDeFi risk manager · 2019 · SingaporeBlock Analitica (BA Labs) is a Singapore DeFi risk firm, Sky's risk team since 2019, and was risk curator of Summer.fi's Lazy Summer vaults until 2026.
SentoraDeFi risk manager · 2025Sentora is the institutional DeFi firm formed in 2025 when IntoTheBlock merged with Trident Digital. It runs vaults for Kraken DeFi Earn, Euler and Morpho.
Frequently asked questions
Is it LlamaRisk or Llama Risk?+
The firm writes it as one word, LlamaRisk. Both spellings refer to the same company at llamarisk.com.
Who manages risk for Aave now?+
LlamaRisk, with Aave Labs as co-signer on the Risk Steward and Risk Council multisigs, since Chaos Labs' offboarding began on 8 April 2026.
What is LlamaGuard?+
LlamaRisk's risk-infrastructure product, split into valuation, verification and enforcement, meant to price collateral and trigger automated responses in real time.
Did Aave depositors lose money in the rsETH exploit?+
Most of the collateral was recovered by liquidating the attacker, and a coalition committed ETH for the rest. We have not seen a final accounting that confirms every market was made whole.
What changed
- Profile published.
Compiled by
Blockchain Security Researcher · September 27, 2026
We have no commercial relationship with LlamaRisk and earn nothing from any link on this page. Every fact above carries the date it was true and a link to where it comes from; if one is out of date, the contact page reaches the editor who keeps this file.