Aave overhauls listing standards after $230 Million rsETH exploit exposed bridge risks

An official postmortem traced the exploit to a LayerZero bridge verification failure and outlined a sweeping overhaul of Aave's asset-listing standards as DeFi risks shift beyond smart contract bugs.\nWhat to know : Aave said the record 2026 rsETH exploit stemmed from a failure in KelpDAO’s LayerZero-powered bridge, not a bug in Aave’s own smart contracts, prompting a sweeping review of all V3 assets and listing standards. In its postmortem, Aave detailed how attackers abused a single LayerZero verifier to forge a cross-chain message and mint 116,500 unbacked rsETH on Ethereum, exposing hidden risks in bridges and other off-chain infrastructure. Aave plans to overhaul its risk framework to scrutinize bridges, oracles, custodians and operational security, add automated defenses that can instantly strip collateral of borrowing power, and has already made hundreds of parameter changes to curb exposure.