Aave governance is preparing a wider overhaul of how the protocol onboards collateral and lists new assets, following the KelpDAO rsETH exploit that produced more than $71M in bad debt and forced an emergency liquidation across the Core instance. CoinDesk reported on May 7, 2026 that risk contributors and core developers are now pushing changes to listing checks, parameter setting, and ongoing monitoring of liquid staking and restaking collateral.
The move is the structural response to an incident the protocol has been digesting for almost two weeks. As of May 7, 2026, BTC trades at $80,267 (down 1.8% in 24 hours) and ETH at $2,300 (down 2.8%), with the Fear and Greed index sitting at 49 (Neutral), so the backdrop is calm enough for Aave to focus on plumbing rather than firefighting price action.
The incident behind the rule change
The exploit targeted KelpDAO's rsETH, a liquid restaking token that was usable as collateral on Aave's Core market. After the attacker drained value out of the underlying restaking position, the rsETH price reference on Aave moved sharply against borrowers using it as collateral, triggering emergency rsETH liquidations that recovered roughly 90% of the bad debt for the protocol's reserves.
A separate civil action also pulled the leftover stolen ETH into a North Korea debt fight, with a US law firm asking a court to block a $71M crypto seizure tied to attribution claims. Aave's legal team has separately asked the court to block that seizure on the grounds that the assets are protocol collateral, not the attacker's property.
That left governance with two open questions: how an audited LRT made it into Core with a parameter set that allowed this exposure, and what changes would prevent the next one from looking the same.
On the table
According to the CoinDesk report, the proposed overhaul covers several layers of the listing pipeline rather than a single parameter tweak. The contributor discussion centers on:
- Stricter pre-listing review for liquid staking and restaking tokens, including tighter requirements on oracle design, redemption mechanics, and underlying validator or operator concentration.
- Lower initial supply and borrow caps for new LRT and LST collateral, with caps tied to on-chain liquidity rather than market cap.
- More conservative liquidation thresholds and bonuses for restaking collateral, reflecting the slower exit paths these assets have versus pure ETH.
- Faster freeze and pause triggers when an underlying protocol shows signs of compromise, so collateral can be ringfenced before bad debt builds.
The framing inside the contributor thread is that the KelpDAO incident did not break Aave's risk engine, it broke the assumption that an LRT can inherit ETH-like risk parameters once it has been audited. Reusing ETH-style settings for assets that depend on a separate validator set, a separate operator set, and a separate withdrawal queue is now treated as the structural error.
A market-structure event
Aave is the largest lending market in DeFi, and on-chain data this week confirmed how dominant. The protocol logged $1B in fees in 19 days as TVL hit a fresh all-time high. The market it sets standards in is the one most other lenders price off.
Three implications follow.
First, LRT issuers will face a harder onboarding bar. Tokens that were positioning for fast Core listings now have to plan for longer review, smaller initial caps, and tighter oracle requirements. That slows the loop where a new restaking project can rely on lending integrations to bootstrap demand.
Second, existing LRT and LST collateral on Aave is likely to see retroactive parameter reviews. Borrow caps and liquidation thresholds that were set during a more permissive era can be tightened the same way GHO's borrow cap was lifted to 150M, just in the opposite direction.
Third, smaller competing lenders that fast-followed Aave's listings now have to decide whether to mirror these changes. Most do not have the contributor bandwidth to run the same risk reviews independently, so Aave's standards effectively set a floor for how DeFi onboards restaking assets.
What it does not change
The overhaul is a process change, not a recovery announcement. It does not refund users who took losses on the rsETH side, it does not affect the ongoing seizure dispute over the stolen ETH, and it does not address Aave's response to KelpDAO in court. Those tracks continue separately.
It also does not directly touch GHO, stablecoin issuance, or the v4 architecture work, all of which run on their own timelines. The contributor discussion is narrowly scoped to the part of the system that failed: how new collateral gets in, how it is monitored, and how fast it can be removed.
Overview
Aave is responding to the KelpDAO rsETH exploit with a structural rewrite of how collateral is reviewed, listed, and parameterized rather than a one-off freeze. If the proposals pass governance, the immediate effect will be slower LRT and LST onboarding and tighter caps on the assets already live, with knock-on effects across every lending market that uses Aave as a reference.
