Aave V3: E-mode Concentration and the April Stress Drill
Most coverage of Aave's April KelpDAO incident framed it as a one-off cross-chain bridge problem. The Galaxy Research V3 snapshot at block 24932111 reframes it as the visible piece of a larger structural exposure that is still on the book today. E-mode is now 58.84% of Aave V3's debt, runs at debt-weighted leverage above 10x, and concentrates ~80% of collateral into three correlated assets. weETH alone backs ~48% of e-mode collateral. A 10% weETH depeg, smaller than the price move that produced the rsETH event, would move $2.47B of debt against $2.42B of post-shock collateral with 205 accounts underwater. The April event reads as a smaller drill of the larger exposure that has been sitting on Aave's balance sheet through a year of bull-market liquidity.
The Scale
Aave V3 ran $10.7B of total loans against $17.37B of collateral as of the Galaxy snapshot. System-wide debt-to-collateral was 61.65%. That headline number masks a sharply bimodal book.
| Segment | Debt | Collateral | Debt-to-collateral | Share of debt |
|---|---|---|---|---|
| E-mode | $6.3B | $7.05B | 89.4% | 58.84% |
| Non-e-mode | ~$4.4B | ~$10.3B | 42.7% | 41.16% |
| System | $10.7B | $17.37B | 61.65% | 100% |
Per Galaxy Research V3 snapshot, April 22, 2026, Ethereum block 24932111. Non-e-mode segment derived from system minus e-mode.
The e-mode segment runs at debt-weighted LTV ~90%, health factor ~1.05, and debt-to-equity ~10.4x. About five points of price headroom separate the median e-mode loan from liquidation. That leverage is consistent with how e-mode was designed to work: pairs of tightly correlated assets (LST against ETH, stable against stable) get preferential LTV ceilings precisely because their price moves are supposed to track. The leverage is the feature.
The risk question that follows is structural. Once e-mode crosses from a tail of the book into the majority of it, the protocol's solvency picture depends on whether the correlation assumption underneath e-mode actually holds at the scale the position has reached. The April event was the first live test of that assumption at production scale.
The Concentration Read
The composition of e-mode collateral is the part that matters for tail risk. Three assets back roughly 80% of e-mode collateral, and one of them (weETH, the ether.fi liquid restaking token) backs roughly half of it on its own.
Galaxy snapshot April 22, 2026. weETH share is the published Galaxy figure (~48%). rsETH and wstETH shares are illustrative within the published top-3 ~80% combined total; the Galaxy report names the top-3 cohort but does not give per-asset splits for ranks 2 and 3 in the public release.
Two things have shifted in the e-mode book over the last twelve months. The first: the dominant asset class has moved from LST (wstETH) to LRT (weETH and rsETH). LSTs are claims on staked ETH validator returns. LRTs are LSTs that have additionally been delegated to EigenLayer to secure actively validated services. They carry the underlying ETH staking risk plus EigenLayer-level slashing risk plus AVS-level operational risk. They are higher-yield because they are higher-risk, and the protocol has not changed e-mode's preferential LTV ceilings to reflect that.
The second: single-asset concentration has gotten extreme. weETH at ~48% of e-mode collateral means a single token's depeg sets the loss curve for the largest part of the book. The April KelpDAO incident hit rsETH, the second-largest LRT in e-mode. The Galaxy snapshot makes clear that the equivalent shock against weETH would be roughly an order of magnitude larger by dollars at risk.
Stress Test Math
Galaxy ran two named depeg scenarios against the April 22 book. Both apply a 10% downward price shock to a single LRT and recompute system health factors against post-shock collateral marks.
| Scenario | Debt at risk | Post-shock collateral | Accounts < HF 1 | Profile |
|---|---|---|---|---|
| 10% weETH depeg | $2.47B | $2.42B | 205 | Broad |
| 10% rsETH depeg | $1.16B | n/a (whale-concentrated) | 22 | Whale-heavy |
Galaxy Research V3 snapshot, April 22, 2026. Stress shocks are applied to a single asset and do not include second-order liquidation cascades or stablecoin-utilization spikes.
The weETH case is the one to internalize. $2.47B of debt against $2.42B of post-shock collateral means the weETH-collateralized portion of the book runs roughly $50M net negative on the price shock alone, before any cascade. 205 accounts go below health factor 1 simultaneously, which is the level at which the liquidation engine becomes the protocol's primary defense.
The rsETH case is structurally different. $1.16B of debt at risk, but only 22 accounts. That tells you the rsETH book is dominated by a small number of whales running large loops. The April event was a whale-concentrated stress test. The weETH case would be a broad-based stress test, with two key consequences: more parallel liquidation throughput required, and more liquidator capital tied up across more positions when WETH pool utilization spikes.
One missing layer in the Galaxy stress is the second-order cascade. Aave's April response cut WETH Slope2 from 10.5% to 3% to prevent rate-driven bad-debt acceleration. That stabilized WETH but pushed stablecoin utilization to 100% and stable borrow rates toward 15% as loopers borrowed stables against now-illiquid aWETH as a synthetic exit. A weETH shock that triggers the same emergency response would push the same dynamic at twice the dollar scale.
The April Drill
The April 18, 2026 KelpDAO / LayerZero exploit drained ~$290M of rsETH via a compromised single-DVN bridge configuration. The attacker deposited 89,567 rsETH (~76.9% of the stolen total) as Aave V3 collateral across Ethereum and Arbitrum, then borrowed 82,650 WETH and 821 wstETH (~$193M combined). Aave's contracts, oracle, and liquidation engine all operated as designed. The protocol was left holding leveraged positions whose underlying collateral backing had been bridge-drained.
LlamaRisk produced two scenarios for final Aave bad debt. Scenario 1 (~$124M) assumes Kelp DAO allocates losses primarily to L2 rsETH (backed only by the OFT Adapter, drained to 26.46% of original reserves). Scenario 2 (~$230M) assumes losses spread across both L1 and L2 rsETH. The Aave DAO's available coverage stack is treasury (~$181M, of which $52M is stables, $54M is AAVE tokens, $62M is ETH-correlated) plus the Umbrella WETH Safety Module (~$54M, but ~80% of the module is in unstaking cooldown). Scenario 1 is comfortably covered. Scenario 2 sits roughly at parity with treasury plus Umbrella combined.
The Arbitrum Security Council froze $71.5M of attacker ETH on-chain using the first-ever invocation of ArbitrumUnsignedTxType. Whether and how that capital can be redirected to Aave is the open governance question.
The relevant point for forward risk: BGD Labs flagged the single-DVN risk during rsETH listing review in February 2025 and recommended a multi-DVN configuration. The recommendation was not adopted. Aave accepted rsETH at up to 95% e-mode LTV without scoring the bridge's DVN security posture as part of the listing decision. Independent of the broader bridge-blame question, this is the lesson the protocol is now wearing: any token whose value depends on a cross-chain bridge invariant must have that bridge's security posture priced into its collateral risk score.
What to Watch
Five concrete watch items for the next 90 days, in priority order:
- weETH share of e-mode collateral. The Galaxy snapshot read of ~48%. If that number drifts above 55%, the weETH-stress numbers grow more than linearly because every additional dollar of weETH collateral at high debt-weighted LTV adds disproportionate accounts to the < HF 1 cohort. If it drifts below 30%, the protocol has materially reduced its single-asset exposure even with the rest of the book unchanged.
- E-mode debt-weighted LTV. The April 22 number is ~90%. If governance moves the e-mode LTV ceiling on LRTs down (the structurally correct response to the rsETH event), the debt-weighted LTV should drift below 85% over a few weeks as new positions enter at the lower ceiling and old ones liquidate or get refinanced. If the number stays at ~90%, governance has chosen not to reprice LRT risk through the parameter framework.
- Kelp DAO loss-allocation decision. Determines whether Aave absorbs Scenario 1 (~$124M) or Scenario 2 (~$230M) in bad debt. The treasury plus Umbrella stack covers Scenario 1 cleanly. Scenario 2 sits at parity, with Umbrella's 80% unstaking-cooldown drag making the actual deployable backstop materially smaller than the headline figure.
- V4 hub-and-spoke migration on LRT spokes. V4's risk-premium pricing prices borrows by collateral type, which is the structural fix for the cross-subsidy that produced the rsETH outcome. The migration timeline is the variable that determines whether the next stress event runs through V3 (pooled, the architecture that produced the April outcome) or V4 (isolated, with risk premiums).
- Umbrella module unstaking cooldown ratio. The April reading was 80% of the WETH Safety Module already in cooldown, meaning the backstop is structurally smaller than the dashboard headline. If governance does not re-incentivize Umbrella staking, the safety module is on a slow path to functional zero, and the treasury becomes the only line of defense in a Scenario 2 event.
Closing Thoughts
Aave is still the category leader by a wide margin. The April event did not break the protocol's contracts, oracle, or liquidation engine. What it broke was the assumption that a pooled-liquidity book could quietly accumulate concentrated leverage into one collateral class without depositors being underwriting that concentration at a price that reflects the tail risk.
The Galaxy snapshot is useful precisely because it shows that the structural exposure underlying the April outcome has not been resolved. weETH at 48% of e-mode collateral is a larger version of what rsETH was on the morning of April 18. The risk parameters have not been tightened materially against LRTs since the event. The Umbrella backstop has gotten smaller, not larger, because of the unstaking cooldown dynamic. V4 is the structural fix, and V4 migration is the open variable.
For TokenIntel users tracking AAVE as a signal asset, the read is unchanged from the broader research page: hold with active monitoring, category-leader exposure, but the structural risks Galaxy's snapshot makes visible should weight more heavily than they did before April. The protocol is repairable. The question is the speed of the repair.