Review library / Coin
Long-running, shipping DeFi lender with audits and no enforcement action found; ecosystem risks remain
Aave is a decentralized lending protocol that has shipped product since 2020 and keeps publishing upgrades such as V3, Governance V3, the buyback program and V4 deployments. Its own security primer says audits by Trail of Bits, Blackthorn and ChainSecurity found no critical or high-severity issues. Multiple outlets report the SEC ended its four-year investigation without recommending enforcement, and no regulator warnings or court cases were found in the notes. Weak spots: the notes give no named team roster or corporate jurisdiction for Aave Labs, there have been governance disputes over fees, and third-party exploits and a market freeze have touched the ecosystem.
Get instant hack alerts
Before you trust a project, know when something goes wrong in the market. We message you when a major hack, exploit or fraud is confirmed.
What they promised vs what happened
| Promised: Build and keep shipping a decentralized lending protocol with a public roadmap and changelog | The official changelog shows ongoing releases, including an API/SDK launch on 2025-07-03 and Aave V3.4 changes. Aave V1 launched on mainnet on 2020-01-08.kept |
| Promised: Aave V4 launch targeted for 'Q4 this year' (governance roadmap thread) | Blog and governance posts show V4 launching on Avalanche and deployments on Base. The notes don't show the roadmap post's date, so whether it hit the original target can't be confirmed.unclear |
| Promised: AAVE Buyback Program as a token value-support mechanism | Governance approved it in August 2024 and, per the token docs, execution began in April 2025.kept |
| Promised: Governance V3 with gasless voting, voting representatives and the Aave Robot | Governance V3 was approved in December 2023 with those features, according to Blockworks.kept |
| Promised: Audited security, with no critical or high-severity findings | Aave's own security primer reports this for audits by Trail of Bits, Blackthorn and ChainSecurity. This is a self-published claim; Aave also promotes an AI-assisted security review of V3 and V4.kept |
What people are saying
55% positive · 25% negative · the rest neutral, estimated from the public posts and reviews in our sources.
- Strong coverage of real product development and new markets such as tokenized-stock collateral on Base
- Concern over governance friction between Aave Labs and the DAO, including a dispute over roughly $10M in annual swap fees (Rekt)
- Worry about ecosystem incidents: a third-party adapter exploit (~$310K claimed) and a reported 114 ETH theft via a third-party tool
- CoinDesk reported a multibillion-dollar deposit exodus after the KelpDAO exploit, though Aave itself was not hacked
- Market freezes after a suspected Binance-related theft showed Aave's risk controls in action but also its exposure
Red flags
- The notes give no named founders or executives and no clear corporate jurisdiction for Aave Labs
- Governance disputes over fee flows between Aave Labs and the DAO, reported by Rekt
- Third-party tools and adapters tied to the Aave ecosystem have been exploited; one attribution was unverified when reported
- Aave froze markets after a suspected exchange-hack borrower used its liquidity, and kept nine assets at zero LTV when reopening
- Deposits reportedly fled after the KelpDAO exploit, despite Aave itself not being hacked (CoinDesk), showing contagion risk
- Smart-contract protocols carry inherent risk even when audited; audit results are partly self-reported
Good signs
- Live since 2017 (as ETHLend) and 2020 (V1), with regular, documented releases
- Published audits from three named firms reporting no critical or high-severity findings
- Multiple outlets report the SEC closed its four-year probe without recommending enforcement
- No FCA, VARA, FSA Seychelles, ASIC, CFTC or state action naming Aave was found in the notes
- No lawsuits or class actions found
- No confirmed hack of Aave's core protocol found in the sources
- Funds independent security journalism (Rekt News) and has open public governance
- Engages regulators openly through SEC and FCA comment letters
Key facts
OriginLaunched as ETHLend in Nov 2017; Aave V1 mainnet 8 Jan 2020
Developer entityAave Labs (jurisdiction not stated in the sources)
GovernanceAave DAO; Governance V3 approved Dec 2023
Token buybackApproved Aug 2024; execution began Apr 2025
Audits (self-reported)Trail of Bits, Blackthorn, ChainSecurity: no critical/high findings
SECFour-year investigation reported closed without recommended enforcement (outlets cite differing dates)
Funds raisedNo clean official figure in the sources
Timeline
- 2017-11Project launched as ETHLend
- 2020-01-08Aave V1 launched on Ethereum mainnet
- 2022-03-16Aave V3 launch cited in research materials
- 2023-12Governance V3 approved
- 2024-08AAVE buyback program approved by governance
- 2025-04Buyback execution began
- 2025-07-03API/SDK launch listed in the official changelog
- 2025-12-16The Block reported the SEC ended its multi-year Aave probe (other notes give a different date)
- 2026-04KelpDAO exploit; CoinDesk reported a large deposit exodus though Aave itself was not hacked
- 2026-11-03Aave Labs, Kamino and Veda urged the SEC to clarify DeFi lending rules
Their side
Aave's security primer says audit findings were addressed and re-validated. After the SEC probe ended, The Block reported the Aave CEO as saying 'DeFi will win'. The notes give no detailed Aave response to the governance fee dispute or the third-party exploit reports.
Bottom line
Aave looks like one of the more established, transparent DeFi lenders in this research, but 'no enforcement found' and 'audited' do not mean risk-free. Use only money you can afford to lose, understand that smart-contract and ecosystem-contagion risks exist, and check the official governance forum yourself. This is not investment advice.
Scan a token for riskAsk us to review somethingWere you involved with Aave?
Tell other people what happened. Reports are screened by our agents, published anonymously and labeled as unverified user reports. Never share your seed phrase or passwords with anyone, including us.
Related on VaultX
Sources
- Aave Docs changelog
- AAVE token docs
- Blockworks: Aave overview
- Aave V4 launch roadmap (governance)
- Aave blog
- Aave security assessment brief
- Rekt: Aave winter of discontent
- The Block: SEC ends Aave probe
- CoinMarketCap: SEC closes four-year Aave investigation
- CoinDesk: Aave coverage
- CryptoSlate: Aave news
- Rekt News governance thread
- Aave Labs SEC policy submission
- Crypto Times: Aave, Kamino and Veda urge SEC
How we review: our AI agents read official materials, independent news, regulator databases and public user reports, then score delivery, transparency, legal record, money and community. Allegations are attributed to their source. This is not financial advice and not a statement of fact about any person's intent. Are you Aave? Send us a correction or your side, and we'll re-check and update this page.
Get alerts on new reviews and risk changes
New VaultX reviews and material risk changes on projects we cover. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reviews are also posted on our alerts channel. Not financial advice. 
VaultX