Best Crypto Yield Aggregators
Top rated: Convex 7.7
Vaults that move capital between strategies for you.
3rated →
8.0/10
Lending Platforms
Company file: Aave, owners, incidents →
Aave
The benchmark for on-chain lending, with about $19.2B locked (27 Sep 2026). Every position is over-collateralised and every parameter is visible on-chain. Its code has held, but its collateral choices have not always: in April 2026 an attacker borrowed about $193M against unbacked rsETH, with the gap covered by liquidations and the DeFi United coalition.
Best for: Over-collateralised on-chain lending with a public risk framework
Company file: Aave, owners, incidents →How this score was reached
8.0 is the weighted average of the five pillar findings below. Does the job well with no material unresolved concerns.
- Custody & Security35%
- 8.4
- Cost & Fee Transparency20%
- 8.2
- Regulation & Legal Standing10%
- 6.4
- Performance & Reliability25%
- 8.0
- Access & Support10%
- 7.6
Non-custodial and heavily audited, with over-collateralisation enforced in contract; no operator can lend deposits out. Two 2026 losses came from inputs rather than Aave's code: a wstETH CAPO oracle misconfiguration (10 Mar 2026) wrongly liquidated users for 512.48 ETH, reimbursed from the treasury without per-user accounting, and the rsETH exploit (18 Apr 2026).
Rates are set by transparent on-chain curves with no discretionary spread taken by an operator.
Unlicensed protocol with functioning on-chain governance and a published risk framework.
Liquidation machinery has cleared crashes that broke smaller lenders. But on 18 Apr 2026 an attacker borrowed about $193M against 89,567 unbacked rsETH, and the incident report modelled up to $91.8M of bad debt on the Ethereum Core WETH reserve alone. Liquidations on 6 May 2026 and DeFi United (including 25,000 ETH from the Aave DAO) were to cover it; no independent audit of the final accounting has been seen.
Well documented; the interface assumes the user understands collateral factors and liquidation thresholds.
Strengths
- Over-collateralisation enforced by contract — rehypothecation is not possible
- Liquidation machinery has cleared crashes that broke smaller lenders
- All parameters visible on-chain with a published risk framework
Against it
- Liquidation risk is entirely yours to manage
- A bad collateral listing can put nine figures at risk, as rsETH did in Apr 2026
- Interface assumes real familiarity with collateralised borrowing
The code held; the collateral did not
Celsius, BlockFi, Voyager and Genesis all failed the same way: they lent out deposits in ways their terms permitted and their users had not read. Aave cannot do that. Over-collateralisation is enforced in contract, every parameter is on-chain, and its liquidation engine has cleared crashes that broke smaller lenders. That structural difference is why it ranks above every custodial platform in this table.
Its 2026 record shows where the risk moved. On 10 Mar 2026 a misconfigured wstETH price cap liquidated 34 accounts for 512.48 ETH; the DAO reimbursed them from the treasury, without per-user accounting. On 18 Apr 2026 an attacker deposited 89,567 unbacked rsETH from Kelp's bridge and borrowed about $193M. Liquidations on 6 May and the DeFi United coalition, including 25,000 ETH from the Aave DAO, were to close the gap; we have not seen an independent audit of the final accounting.
Frequently asked questions
Is Aave safer than a custodial lending platform?+
Structurally, yes. Your collateral cannot be lent to a third party because the contract does not permit it, and every parameter is visible on-chain. What you take on instead is smart-contract and collateral-listing risk, and full responsibility for your own liquidation level.
What happened with rsETH on Aave in April 2026?+
An attacker spoofed a LayerZero message to mint unbacked rsETH, deposited 89,567 of it on Aave and borrowed about $193M, mostly WETH. The loss began in Kelp’s bridge, not Aave’s contracts. The incident report modelled up to $91.8M of bad debt on the Ethereum Core WETH reserve; liquidations and the DeFi United coalition were to cover it.
Where does Aave’s yield come from?+
Interest paid by borrowers, set by transparent on-chain rate curves. That is knowable and checkable, which is exactly what the double-digit stablecoin yields of the 2022 custodial platforms were not.
Assessed by
Blockchain Security Researcher · September 27, 2026
◆ Disclosure
CoinRadar Daily is a non-commercial project. We have no commercial relationship with Aave, earn nothing from any link on this page, and carry no advertising or sponsorship anywhere on the site. Findings rest on public sources; we did not open an account or transact.
Rubric v2.0How we score →
The rest of the lending platforms table
- 01Aave — you are hereOver-collateralised on-chain lending with a public risk framework8.0
Related tables
How we score →Independent, rubric-scored tables for the services behind this story.
Best Stablecoins
Top rated: USDC 8.5
A stablecoin is a promise about redemption.
4rated →
Best DeFi Protocols
Top rated: Uniswap Protocol 8.9
The base layer everything else is built on.
4rated →