Is Aave safe? The real risks explained

"Is Aave safe?" is really several questions at once. Money on Aave can be lost in more than one way, and some of those ways have happened. Here is each risk in plain terms, for lenders and borrowers, using documented incidents rather than guesses.

Smart contract risk

Aave is a set of smart contracts, and code can have bugs. A serious one could let an attacker take funds, and no bank or insurer stands behind them.

Each new version is reviewed by outside auditors; version 3.7 had four audits, plus two AI-assisted reviews, in March 2026. One of the auditors, Certora, also uses formal verification, which uses maths to check that key rules always hold. In October 2026 Aave's security page offered up to 5 million dollars for a critical bug in its core V3 contracts, with a separate bounty for V4.

Audits make bugs less likely, not impossible. In August 2024, helper contracts behind swap features in the Aave app lost about 95,000 dollars in leftover tokens, and Aave Labs' report says no core contracts or user funds were affected.

Oracle risk: when the price is wrong

Aave reads prices from oracles chosen by governance for each asset. Its documentation names two main kinds: Chainlink price feeds, which combine several data sources, and CAPO, the correlated assets price oracle, for tokens that track another asset, such as wstETH. CAPO caps how fast their exchange rate may grow, so an inflated rate cannot inflate collateral.

A wrong price can do damage without any hack. On 10 March 2026, a settings mismatch left CAPO's wstETH price about 2.85% too low. That was enough to liquidate about 10,938 wstETH, roughly 26 million dollars, from 34 E-Mode accounts. The post-mortem reports no bad debt, and affected users were to be repaid, partly from the Aave treasury.

Borrowers: liquidation risk

If your health factor falls below 1, anyone may repay part of your debt and take some of your collateral plus a bonus, which is your penalty. There is no warning and no grace period. Falling collateral, a rising debt asset or months of interest can all get you there, as how Aave liquidations work explains.

As March 2026 showed, a faulty price can trigger it too. A wide buffer protects against both, and the liquidation price calculator shows where your line is.

Lenders: liquidity risk

Suppliers can only withdraw what is not lent out. When a pool is 100% utilized, withdrawals wait until borrowers repay or new deposits arrive. Your deposit keeps earning interest, but you cannot take it out on demand. Rates climb steeply near full use to pull money back in (see how Aave interest rates work).

In the April 2026 rsETH incident below, the incident report by LlamaRisk, one of Aave's risk providers, found WETH pools on Ethereum, Arbitrum, Base, Linea and Mantle all at 100% utilization, with under 20 dollars of idle WETH on each. The utilization page shows how close each pool is.

Depeg and bridge risk

Stablecoins and staked tokens are meant to track another asset, but the link can break. When USDC briefly fell to about 88 cents in March 2023, after Silicon Valley Bank failed, the risk provider Gauntlet reported about 300,000 dollars of bad debt on Aave, mostly on Avalanche. A token that stays depegged loses value whatever Aave does.

Many tokens outside Ethereum are bridged copies, backed by tokens locked elsewhere. If the bridge fails, the copy can lose its backing. When the Horizon bridge to Harmony was exploited in June 2022, bridged tokens on Aave's Harmony market lost value and borrowing there was stopped.

Bad debt and the backstop

Bad debt is debt the collateral can no longer cover, even after liquidation. Since version 3.3, Aave records it as a "deficit" on the asset when an account is left with debt and no collateral. Two documented cases:

LlamaRisk's incident report on Aave's forum says Aave's contracts were not compromised. The loss came from accepting collateral whose backing failed elsewhere.

The old backstop was the Safety Module, where staked AAVE and related tokens could be partly used to cover a shortfall. Since June 2025, Umbrella has been gradually replacing it. People stake wrapped aTokens, such as aUSDC, aUSDT or aWETH, or GHO, for rewards. If that asset on that network records a deficit, staked tokens are slashed automatically and sent to the Aave treasury to cover it, after a first slice that the DAO absorbs. Unstaking takes a 20-day cooldown, and the cover is only as large as what is staked.

Safety controls and what you can do

An emergency guardian can freeze an asset (no new supply or borrowing, but repaying and withdrawing still work) or pause it entirely. Risk stewards run by Aave's risk providers can adjust caps, rates and collateral settings in small steps, and supply and borrow caps limit the exposure one asset can create. In April 2026 the guardian began freezing rsETH on every V3 market about 90 minutes after the exploit.

A few habits lower your own risk:

• Keep a wide health factor buffer. Test price drops in the health factor calculator before you borrow.
• Diversify. Spreading funds across assets, markets or protocols limits the cost of any one failure.
• Prefer large, established markets. Deep pools are easier to liquidate cleanly and easier to leave. Compare them on all markets.
• Count the links behind a token. Each wrapper, restaking layer or bridge is one more thing that can fail.
• Watch an asset's status. A frozen or paused asset, or one near its caps, deserves a closer look. The wallet checker shows your live position.

What history shows

Aave's record includes real losses: CRV in 2022, the USDC depeg in 2023, a faulty oracle setting and, far larger, a bridge failure in 2026. It also shows them being contained: assets were frozen quickly, the treasury covered the CRV gap and an industry effort restored rsETH's backing. None of these began with a bug in Aave's core contracts.

What nobody can guarantee is that the next incident will go the same way. Audits do not prove code is bug-free, backstops only cover what is staked, and help from the treasury or partners is a choice, not a promise. Size your positions for the chance that something goes wrong.