Aave Pauses Token Buybacks Following rsETH Bridge Exploit

Aave has formally paused its AAVE token buyback program following the April 18 rsETH bridge exploit, prioritizing treasury flexibility until the incident's resolution becomes clear. The suspension is temporary and contingent on stabilization of the underlying situation.

On April 18, 2026, a critical vulnerability in Kelp's LayerZero bridge for rsETH enabled attackers to mint unbacked tokens across multiple Aave V3 deployments. The incident triggered an immediate response from Aave's Protocol Guardian and Risk Steward, who froze all rsETH and wrsETH positions while adjusting interest rate parameters on WETH markets to contain contagion. The Aave governance community has now formalized a decision to suspend token buybacks indefinitely until the full scope and resolution pathway for this incident become clear.

The decision to pause buybacks reflects a straightforward risk management principle: preserve dry powder. When external variables remain unresolved—particularly those affecting potential bad debt and loss allocation scenarios—deploying protocol revenue into equity repurchases reduces the DAO's flexibility to mount a coordinated response if needed. The rsETH situation remains fluid, with multiple parties involved in recovery discussions and potential loss-sharing mechanisms still under negotiation. Executing buybacks during this window would lock capital into a non-reversible action, potentially limiting the DAO's ability to stabilize markets, provide liquidity support, or absorb unexpected expenses should circumstances deteriorate.

This pause, initiated on April 19, represents prudent treasury management rather than permanent policy. Aave's buyback program has been a cornerstone of its tokenomics strategy, systematically returning protocol profits to token holders and supporting price stability. The suspension is explicitly temporary, contingent on achieving clarity around the incident's resolution. Once the rsETH situation stabilizes—whether through insurance recovery, settlement agreements, or other mechanisms—buyback resumption will be communicated through standard DAO funding updates, ensuring transparent governance.

The incident underscores a recurring lesson in decentralized finance: bridge security remains one of the ecosystem's most critical vulnerabilities, and protocols relying on cross-chain collateral must maintain robust governance safeguards. For Aave, this episode demonstrates that effective risk stewardship sometimes means restraint, not action—a principle likely to influence how other DAOs approach capital allocation during periods of external uncertainty.