Aave Concentrates. Kamino Isolates. Morpho Delegates.

Three 2026 cascades. Three lending architectures. Three different places loss showed up while every liquidation engine ran exactly as designed. The trade-off is unavoidable: lending architecture is a choice about where loss appears when conditions deteriorate, and the channel that fails is the channel the design selected.

1. The Liquidation Engine Is Not the Problem

Each of the three events below ran through liquidation infrastructure that worked. Aave's smart contracts fired on every position that crossed its threshold. Kamino's 10% close-factor framework cleared $41.7 million of collateral in controlled increments. Morpho's vault contracts executed each repayment instruction in sequence. The auto-pause and risk-steward responses also fired correctly: Aave's Protocol Guardian froze rsETH across 11 markets within hours of the depeg; Aave's Risk Steward cut WETH borrow rate from 10.5% to 3% the next day to stop bad debt from compounding through accrued interest.

Three different architectures, three sound liquidation engines, three different outcomes ranging from zero bad debt to a $230 million exposure. The execution layer cannot explain that divergence. Something upstream of liquidation does.

The framework view of this is direct. Vault credit risk lives in five mechanical channels (covered below); each architecture exposes a different channel as its weakest. The pooled-liquidity design at Aave centralizes risk in the concentration of what backs each reserve. The isolated-market design at Kamino removes concentration but fragments capital and operational surface across 26 silos. The modular design at Morpho hands risk parameters to curators while keeping shared price-and-allocation infrastructure that becomes a transmission path when it stalls. None of the three is wrong. Each chose where loss would appear.

2. Three Events, Tightly Stated

Aave V3, April 18 2026: $193M of leveraged liabilities, $230M Scenario-2 bad debt

The Kelp DAO / LayerZero exploit drained ~$290M of rsETH via a compromised single-DVN configuration. The attacker deposited 89,567 rsETH (76.9% of the stolen total) as collateral on Aave V3 across Ethereum and Arbitrum, borrowing 82,650 WETH + 821 wstETH (~$193M combined) in real ETH-denominated liabilities. Aave's smart contracts, liquidation mechanism, oracle, and governance process all operated as designed. The protocol was left holding leveraged debt against collateral whose underlying backing had been drained. Per LlamaRisk's loss scenarios, the bad-debt range is $123.7M (uniform socialization) to $230.1M (L2 rsETH losses concentrated, the most likely allocation case). BGD Labs had warned Aave about the single-DVN risk during the rsETH listing review in February 2025; the warning was not adopted. The cleanest articulation of the structural lens is in the same-pool report from May 6: Aave's WETH reserve was 98.5% LST-funded at the time of the event, $5.43B of $5.52B in WETH borrow collateral routed through ETH liquid-staking tokens. The pooled rate framework cross-subsidized by collateral class, so every ETH depositor earned the same APR whether their capital was financing a diversified borrowing book or a concentrated levered LST carry trade.

Kamino V2, February 5-6 2026: $41.7M liquidated, $0 bad debt

SOL corrected 34.1% over two days. Kamino, the largest Solana lending protocol with $2.89B end-Q1 deposits, processed $41.7M in collateral liquidations and $41.3M in debt repaid across the quarter, with 62.7% of liquidations concentrated in the February correction itself. The platform's 10% close-factor framework allowed positions to unwind in controlled increments rather than cascading into forced selling. Borrower behavior through the drawdown was notably stable; leverage was maintained rather than unwound. Across the protocol's 26 isolated markets, no single market experienced contagion to another. Bad debt across all markets: zero. The RWA markets saw virtually no liquidation activity at all, validating the lower-risk collateral profile of tokenized-asset isolation. The Q1 cost of this risk containment is also visible: revenue contracted 32.8% QoQ from $3.85M to $2.59M as crypto-leverage demand tracked SOL's correction.

Morpho, March 2026: $200K attacker capital, $80M unbacked mint, $3.8M Resolv cascade

An exploit on Resolv triggered a USR (Resolv's stablecoin) issuance failure: ~$200K of attacker capital led to an $80M unbacked USR mint. The mechanical transmission to Morpho was the part the architecture did not insulate. Oracle latency on Morpho markets meant price feeds did not update quickly enough to reflect the depegged USR. Automated allocators across multiple Morpho vaults continued routing inflows into markets that were already stressed. By the time the mark caught up and curators could adjust parameters, $3.8M of bad debt had accrued across markets. The liquidation mechanism worked at every step it was asked to run; the issue was the gap between when the mark should have moved and when it did, combined with allocators that were not stress-conditional. TI's risk methodology recalibrated after this event to weight oracle update cadence on stress-correlated collateral and auto-allocator stress-conditionality more heavily.

3. The Framework: Five Channels, Not One

TI's vault credit risk framework (adapted from Anastasiia's Vault Summit paper, April 2026) scores mechanical losses across five channels. They are: stress-adjusted asset coverage (does the vault still cover liabilities under stress collateral haircuts), recovery endogeneity (liquidations move the exit venue against you, more so when many fire at once), liquidity stress index (the gap between what the protocol can liquidate and what the venue can absorb), oracle integrity (stale marks during drawdowns or feasible source manipulation), and execution viability (liquidator incentive to show up, gas budget, and wrong-way risk in stress regimes).

These channels are mechanical: they describe how a vault can take losses while every contract operates exactly as designed. They do not score governance quality, parameter calibration, or contract-security risk. Those live in separate layers. The point of the framework is that concentration is not itself one of the five channels. It is a cross-cutting condition that amplifies whichever channel a specific architecture leaves most exposed. That is why "Aave's risk model failed" is the wrong frame for the rsETH event. What failed was the channel concentration selected as the path of least resistance.

4. Where Each Architecture Places Loss

5. Which Channels Fired, by Protocol

The cleanest read of the three events is to ask, for each, which of the five mechanical channels the cascade routed through. Where multiple channels combine, that interaction is the multiplicative-aggregation case the framework anticipates: a single weak channel weighted hard tends to produce a worse outcome than several mildly-weak channels.

Two observations from this layout. First: every protocol scores well on execution viability. The liquidation engine is no longer the question. Second: the channel that broke is the channel each architecture's design weighted least, and that mapping is not random. Aave broke on coverage and recovery endogeneity because pooled liquidity routes correlated risk through both. Kamino held on those two because isolation eliminates the correlated-exposure path. Morpho broke on oracle integrity because modular vaults inherit shared infrastructure that becomes a single point of failure when the marks stall.

6. The Tax Each Architecture Pays

Naming the failure channel is only half the analysis. The honest read also requires naming what each architecture sacrifices to keep that channel intact. Otherwise the comparison reduces to "Kamino won," which is too simple. Each design pays a structural tax, and the question for an allocator is whether the tax is worth the risk relocation.

Aave's tax: depositor cross-subsidy. The pooled-liquidity rate framework compresses materially different risk profiles into a single rate. Every ETH supplier in Aave's WETH reserve earned the same APR through Q1 2026, whether their capital was financing vanilla borrowing or a 5x-levered rsETH carry trade. The rate did not separate. Senior-class depositors were de facto third-loss capital on a concentrated strategy at the price of a diversified-book lender. That is the bug, but it is also the feature: pooled liquidity gives Aave deep, fungible, single-rate financing that competitor architectures cannot match. The April event made the bug expensive; V4's hub-and-spoke + Risk Premiums design is the structural answer if and when it ships at scale.

Kamino's tax: fragmentation and operational surface. Twenty-six isolated markets require twenty-six parameter sets, twenty-six liquidity bootstraps, and twenty-six surfaces for governance to monitor. Kamino's Q1 2026 revenue contracted 32.8% QoQ in part because crypto-leverage demand fragmented across markets that could not subsidize each other through pooled rates. The isolation that produced zero bad debt also produced lower aggregate utilization. The unanswered institutional question is whether allocators with multi-hundred-million-dollar mandates will accept twenty-six smaller venues over one large one. Q2 2026 deals (Anchorage, FalconX, Private Credit) suggest some do; the next two quarters of inflows will resolve whether this generalizes.

Morpho's tax: the curator and the allocator. Modular vaults route risk management to curators, but the shared infrastructure (oracle pipelines, automated allocators, fee skimming, share-token mechanics) is a layer the curator cannot configure away. The March cascade exposed this directly: even with a curator who had set appropriate parameters, oracle latency outside the vault's control plus auto-allocators that were not stress-conditional propagated the loss. The architecture's selling point (customization) is real, but it imports a dependency on the shared infrastructure layer that the architecture's marketing tends to understate.

7. What Would Falsify Each Read

The three reads above each carry a falsifier on a six-to-twelve-month window:

• Aave thesis falsifies if V4 ships hub-and-spoke + Risk Premiums + AWW at scale and the next major correlated-collateral shock produces materially less bad debt at the protocol level than April's $230M Scenario-2 case. If V4 migration stalls (sub-30% of total Aave TVL on V4 by end of 2026) or if a comparable event under V4 still cascades, the "concentration is the design feature, not a bug" framing fails and Aave becomes structurally unsuitable for correlated-LST collateral.
• Kamino thesis falsifies if a Solana-native stress event (network congestion + cross-market oracle lag during a SOL move greater than -40%) produces non-zero bad debt across the isolated markets, OR if institutional Q2-Q3 RWA inflows do not exceed $200M cumulative. Either failure suggests isolation does not transfer to scaled institutional flow, OR that operational complexity has structural limits even within the isolation design.
• Morpho thesis falsifies if the next oracle-latency-driven cascade on a major Morpho market produces bad debt within twelve months, despite the post-Resolv infrastructure recalibration. Specifically: if oracle update cadence improvements and stress-conditional allocator logic do not reduce the gap between mark and market on subsequent depeg events, the architecture's dependence on shared infrastructure becomes a structural attribute rather than a fixable one.

8. The Honest Read

Three protocols, three architectures, three different stress events spanning February to April 2026. The cleanest synthesis is that the next generation of DeFi lending will not be defined by who offers the highest yield or the deepest liquidity. It will be defined by which failure mode allocators are willing to own. Pooled liquidity gives you deep markets at the cost of concentrated tail risk. Isolated markets give you bounded loss at the cost of fragmented capital and operational complexity. Modular vaults give you customization at the cost of dependencies on shared infrastructure the curator cannot fix.

Capital is making this choice with its allocations even when the writeups call it something else. Aave still anchors institutional liquidity. Kamino's RWA share moved from 5.9% to 33% of net interest income in one quarter. Morpho's curator-driven vault model continues to attract issuers like USDG and structured-credit funds despite the Resolv event. There is no winning architecture; there is only an architecture that fits a given allocator's view of which failure mode is tolerable.

For TI's position stack: Aave Hold, with V4 migration as the variable that resolves whether concentration risk is a feature being structurally fixed or a permanent attribute of pooled lending. Kamino Hold, with the multi-chain expansion question and the institutional Q2-Q3 inflow trajectory as the falsifying observations. Morpho: no rating. TI maintains a research page on Morpho but has not published a signal direction on the token; the existing risk-page analysis is the canonical TI read until a position is initiated. The cross-asset frame in this piece does not change that posture. The existing research pages carry the per-protocol detail; the cross-asset read points to architectural divergence, not to a single winner.

If the framing in this piece is correct, the productive reading question is not "which of the three is safest" but "which of the three has a failure mode you can underwrite." That is a portfolio question, not a protocol question, and it is the right one to be asking.