Skip to content

SYSTEM ONLINE

[ SEARCH ]ABOUT
CoinRadar DailyCRYPTO MARKET SURVEILLANCE
LIVE TAPE
BTC$83,699.00▲ 0.1%·
ETH$2,672.86▼ 0.9%·
USDT$0.999623▼ 0.0%·
BNB$766.05▲ 1.4%·
XRP$1.49▼ 0.7%·
USDC$0.99979▼ 0.0%·
SOL$117.77▼ 1.3%·
TRX$0.337634▲ 0.8%·
ZEC$1,420.56▼ 0.3%·
FIGR_HELOC$1.03▲ 2.9%·
HYPE$89.77▲ 3.9%·
DOGE$0.093914▼ 0.3%·
LINK$14.28▼ 2.5%·
XMR$544.22▲ 0.3%·
WBT$83.50▼ 0.2%·
USDS$0.999606▲ 0.0%·
ADA$0.242421▼ 1.0%·
RAIN$0.012237▼ 3.7%·
BTC$83,699.00▲ 0.1%·
ETH$2,672.86▼ 0.9%·
USDT$0.999623▼ 0.0%·
BNB$766.05▲ 1.4%·
XRP$1.49▼ 0.7%·
USDC$0.99979▼ 0.0%·
SOL$117.77▼ 1.3%·
TRX$0.337634▲ 0.8%·
ZEC$1,420.56▼ 0.3%·
FIGR_HELOC$1.03▲ 2.9%·
HYPE$89.77▲ 3.9%·
DOGE$0.093914▼ 0.3%·
LINK$14.28▼ 2.5%·
XMR$544.22▲ 0.3%·
WBT$83.50▼ 0.2%·
USDS$0.999606▲ 0.0%·
ADA$0.242421▼ 1.0%·
RAIN$0.012237▼ 3.7%·
7.9/10
DeFi Protocols

Aave Protocol

Solidranked 4 of 4 in defi protocols◆ Sources checked · 27 Sept 2026

Upgradeable by design, which is a trade rather than a flaw: parameters can be tightened when a collateral type turns dangerous. April 2026 showed the other side. Unbacked rsETH, accepted at up to 95% loan-to-value, was used to borrow about $193M, and the gap was covered by liquidations and the DeFi United coalition rather than by suppliers.

Best for: Actively risk-managed lending, if you check which collateral others may post

Company file: Aave, owners, incidents →

How this score was reached

7.9 is the weighted average of the five pillar findings below. Dependable, with trade-offs a reader should know about first.

Custody & Security35%
8.0

Non-custodial and heavily audited; Aave’s own contracts have not been drained. Every material loss came from a collateral asset or a price feed: the 10 Mar 2026 wstETH CAPO misconfiguration (512 ETH of wrongful liquidations, refunded by the DAO) and the 18 Apr 2026 rsETH exploit. Contracts are upgradeable through governance.

Cost & Fee Transparency15%
8.2

Transparent on-chain rate curves with no discretionary operator spread.

Regulation & Legal Standing5%
6.8

Unlicensed, with a published risk framework and governance process. The Aave Will Win framework (passed 5 Apr 2026) sends revenue from Aave-branded products to the DAO; Chaos Labs left as risk manager in Apr 2026 and LlamaRisk took over.

Performance & Reliability35%
7.8

Liquidations cleared the Nov 2022 CRV squeeze (about $1.6M bad debt, repaid by the DAO) and years of routine drawdowns. The rsETH exploit put about $193M of loans against unbacked collateral; bad debt was modelled at up to $91.8M on Ethereum Core WETH alone, and WETH markets stayed frozen for weeks.

Access & Support10%
7.8

Strong documentation; the risk framework is public and readable. V3 and V4 now run side by side, which adds a second interface to learn.

Strengths

  • Published risk framework and on-chain rate curves
  • rsETH was frozen across all V3 markets within about 90 minutes of the exploit
  • Losses so far were covered by liquidations, the DAO or a coalition rather than by suppliers

Against it

  • Upgradeable contracts mean governance can change the rules after you deposit
  • A single high-LTV collateral asset put about $193M of loans at risk in Apr 2026
  • The rsETH coverage is documented in governance posts, not in an independent final accounting

Upgradeable, and April 2026 showed the cost

Aave can tighten collateral parameters when an asset turns dangerous, and it froze rsETH across every V3 market within about 90 minutes of the 18 Apr 2026 Kelp bridge exploit. That is active risk management no immutable protocol can perform.

The same exploit is why performance and custody are lower than they were. rsETH had been accepted at up to 95% loan-to-value; the attacker borrowed about $193M against tokens with nothing behind them, and bad debt was modelled at up to $91.8M on Ethereum Core WETH alone. Liquidations on 6 May and the DeFi United coalition, including 25,000 ETH from the Aave DAO, covered the gap, per governance posts; we have not seen an independent final accounting. What protects a supplier is the quality of collateral other people may borrow against.

Frequently asked questions

Is an upgradeable protocol less safe?+

Different, not simply worse. Upgradeability lets parameters be tightened ahead of trouble and lets bugs be fixed; it also means whoever controls the upgrade path could do something else. The question is who holds that authority and how concentrated it is.

What is the Aave safety module?+

A staked backstop intended to cover shortfall events. It is finite and would not cover a systemic failure, so treat it as a buffer rather than insurance.

Has Aave ever had bad debt?+

Yes. About $1.6M in the Nov 2022 CRV squeeze, repaid from the DAO treasury, and the rsETH exploit of April 2026, where up to $91.8M was modelled on one reserve and covered by liquidations and the DeFi United coalition. In March 2026 a misconfigured wstETH oracle cap wrongly liquidated 34 accounts for 512 ETH; the DAO refunded them by 1 April.

Assessed by

Emily Volker

By Emily Volker

Editor-in-Chief · September 27, 2026

◆ Disclosure

CoinRadar Daily is a non-commercial project. We have no commercial relationship with Aave Protocol, earn nothing from any link on this page, and carry no advertising or sponsorship anywhere on the site. Findings rest on public sources; we did not open an account or transact.

Rubric v2.0How we score →

The rest of the defi protocols table

  1. 01Uniswap ProtocolPool contracts with no admin key over funds, at the largest scale8.9
  2. 02Lido ProtocolScale and integration, with the concentration question attached8.3
  3. 03MakerDAO / SkyThe longest continuous operating record of any DeFi protocol8.0
  4. 04Aave Protocol — you are hereActively risk-managed lending, if you check which collateral others may post7.9
Full defi protocolscomparison →

Related tables

How we score →

Independent, rubric-scored tables for the services behind this story.