Lending your crypto through an onchain pool is a simple way to earn interest on coins you already hold, or to borrow against them without selling. The catch is that the pool runs on code, price feeds, and shared rules, so you can lose money even when nobody hacks you and the app looks normal.
Aave is one such pool, and the Aave lending protocol lets you supply and borrow from your own wallet on many networks. Some of its pools on Ethereum sit behind an Umbrella backstop against bad debt, which held $148.41 million at last count (source: Aave, Security).
So the answer is a yes with conditions. Aave is safe enough for careful use when you accept smart contract, oracle, collateral, governance, and network risk, keep your health factor well above 1 if you borrow, and treat Umbrella as a backstop for the pool and never as insurance on your own loan.
What is safety for an Aave user?
Safe means two different things on Aave, because the lending protocol and the AAVE token are separate bets. Protocol safety asks whether the code, the prices, the collateral, and the rules protect what you supplied or borrowed. Token safety asks how far the AAVE price can fall and where you keep the coins.
When you supply USDC to an Aave lending pool, you receive aUSDC in return. aTokens such as aUSDC, aUSDT, and aWETH stand for what you supplied. GHO is the stablecoin Aave issues itself (source: Aave, Umbrella). Your aUSDC is a claim on one pool of USDC, so its safety depends on that pool and on the loans made out of it.
The AAVE token is the coin holders use to vote on every change to the protocol. No single company can push a change through alone, Aave Labs included (source: Aave, Security). You can hold or trade AAVE without ever supplying to a pool, and you can supply to a pool without owning any AAVE.
That split matters when you read the news. The AAVE price can drop hard in a week while your aUSDC claim stays whole, and a USDC pool can take bad debt while the token price barely moves. Treat each one as its own position, with its own size and its own exit plan.
| Position | What can go wrong | What to watch |
|---|---|---|
| Supplying to an Aave pool | Bad debt in that reserve, a wait to withdraw, a code bug | How much of the pool is on loan, and what the market accepts as collateral |
| Borrowing on Aave | Liquidation when the health factor falls below 1 | Health factor, oracle prices, interest on the loan |
| Holding the AAVE token | Price swings, coins sent to the wrong network | Where the coins are held, and your position size |
If you came for the AAVE price itself and have no plan to supply or borrow, BloFin gives you another way to trade it. AAVE/USDT Spot buys the token, while the AAVEUSDT Perpetual is a contract that tracks its price, and neither one opens a position on Aave. Check the BloFin fee schedule before you size either order, so the cost of the trade is part of the plan from the start.
Which risks can cost a supplier or borrower money?
Four risks can cost you money in any Aave market: code bugs, wrong oracle prices, collateral that loses value and failures in the network or bridge under the market (source: Aave, Risks). A fifth comes from governance, because the rules can change while your loan is open.
Smart contract risk is the chance that the code, or a token a pool lists, has a bug that someone can use to take funds. To lower it, Aave keeps its code public, pays for outside audits, and has the community review each change before it goes live. A bug bounty also pays outside developers to report flaws (source: Aave, Risks). Those steps make a bug less likely, and they never make it impossible.
Oracle risk is the chance that the price the contracts read is wrong. Aave gets prices from outside providers such as Chainlink, along with data like the rate at which a liquid staking token can be redeemed. A feed that fails or is tampered with can value your collateral at the wrong price (source: Aave, Risks). Your health factor uses the price oracle number, which can differ from the price on the chart you watch.
Collateral risk is the chance that an asset people borrow against loses value or liquidity faster than liquidations can keep up, which leaves bad debt in the pool. Aave sets a loan-to-value ratio and a liquidation threshold for each asset. Governance can change both as markets move (source: Aave, Risks). You carry this risk as a supplier too, because your deposit is what those borrowers took.
Governance risk is the chance that the rules change while your position is open. An approved change waits 1 day before it runs, or 7 days for changes to governance itself. During that wait, a 5-of-9 community Guardian can veto a harmful proposal (source: Aave, Security). Those waits give you time to act, but only if you follow Aave governance votes for the markets you use.
Network and bridge risk is the chance that the chain or bridge under a market fails. Aave runs on many networks and bridges. Each one can face congestion, censorship, or a security flaw (source: Aave, Risks). A token on one network can be a bridged copy of the original, so its value may depend on a bridge you never used.
How the health factor decides liquidation
The health factor is the number Aave uses to judge whether a loan is safe. It divides your collateral value, weighted by liquidation thresholds, by your debt. Above 1 the loan stands. Below 1, anyone can repay part of your debt and take your collateral plus a bonus (source: Aave, Health Factor and Liquidations).
Say you put up $10,000 worth of ETH, which carries an 80% liquidation threshold, and take out a $6,000 GHO loan. Your health factor is 10,000 × 0.8 ÷ 6,000, which comes to 1.333 (source: Aave, Health Factor and Liquidations). If ETH then falls 25%, your collateral is worth $7,500, and 7,500 × 0.8 ÷ 6,000 is exactly 1.0. Any further drop puts the loan below 1 and opens it to liquidation.
That gives you a simple way to read the number. At 1.333, the loan survives a fall of up to 25% in ETH before it can be liquidated. At 1.1, the same loan would survive a fall of only about 9%, since 1 ÷ 1.1 is roughly 0.91. The closer you sit to 1, the smaller the price move that can take your collateral.
How much a liquidator can repay depends on how low the number goes. If your health factor sits between 0.95 and 1, and your collateral and debt are each worth $2,000 or more, a liquidator can repay at most half of the debt in one go. Once the number reaches 0.95 or lower, or when either side is under $2,000, the whole debt can be repaid at once. The number can also fall while prices stand still, because the borrowed amount increases (source: Aave, Health Factor and Liquidations).
Liquidators are usually bots that watch oracle prices and race to send the first transaction, so an Aave liquidation can follow soon after the number drops under 1. You will have no one to call once it starts, which is why the buffer you keep matters more than the price you hope for.
| Health factor | What it means | What you can do |
|---|---|---|
| Well above 1 | Room for collateral to fall or debt to grow | Keep watching, since interest still builds up |
| Close to 1 | A small price move can trigger liquidation | Add collateral or repay part of the loan |
| Below 1 | Anyone can repay debt and take collateral | The liquidation can already be under way |
Umbrella vs the legacy Safety Module
Umbrella is Aave's current backstop for bad debt. Users stake aTokens or GHO, and when a covered reserve records a deficit, the matching stake is burned automatically to cover it. Umbrella is the upgrade of the legacy Safety Module, which needed a governance decision before any staked funds could be slashed (source: Aave, Umbrella guide).
Three limits decide whether Umbrella helps your market. Coverage is set per asset and per network. Staking aUSDC on one network covers USDC deficits on that network only (source: Aave, Umbrella guide). As of December 10, 2025, Umbrella ran only in the Aave V3 Core market on Ethereum, for WETH, USDC, USDT, and GHO, and stake in one reserve could not be moved to cover another. It pays only for a deficit recorded onchain. Even then, it pays only up to the stake held in the module at that moment (source: LlamaRisk, Umbrella Coverage Principles).
Stakers are also not the first to pay. The Aave DAO takes the first part of any loss, an amount called the deficit offset. For USDT that offset is 100,000 USDT (source: Aave, Umbrella). So if a USDT reserve recorded a deficit of 150,000 USDT, the DAO would carry the first 100,000 USDT and 50,000 USDT would be slashed from staked aUSDT. The DAO then refills its share over time from protocol revenue (source: LlamaRisk, Umbrella Coverage Principles).
A loss can exist before Umbrella sees it. If a collateral token loses its backing while the oracle still prices it at par, the pool records no deficit. Nothing is slashed until governance moves to a price feed that shows the real value (source: LlamaRisk, Umbrella Coverage Principles). The gap between a real loss and a recorded deficit is where a supplier can be hurt with no backstop yet in play.
| Feature | Umbrella | Legacy Safety Module |
|---|---|---|
| What stakers lock | aTokens such as aUSDC, or GHO | stkAAVE and stkABPT |
| How a slash happens | Automatically, when a covered reserve records a deficit | Through a governance decision, with stkAAVE and stkABPT both capped at 0% |
Umbrella is taking over from the old stkAAVE and stkABPT modules (source: Aave, Umbrella). By February 2026 the maximum slashing on stkAAVE had been set to 0% (source: Aave Governance, Aave DAO Funding Insights). Staking in either system is a separate decision from supplying or borrowing, so Aave Umbrella staking and stkAAVE staking each have their own guide.
Audits and bug bounties on Aave
Audits and bug bounties lower the odds that a code bug drains an Aave pool, and they cannot remove that risk. Aave counts 65 audits and AI-assisted reviews across its versions and pays outside researchers who report bugs. Even so, smart contract risk cannot be eliminated (source: Aave, Security).
The reviews come from many firms. The first V3 code was checked by OpenZeppelin, Trail of Bits, PeckShield, Sigma Prime, ABDK, and Certora, and later V3 upgrades added reviews from firms such as MixBytes, Pashov, and Enigma Dark. Aave also ran three AI security tools against V3 and V4. Across 71 findings, none was confirmed as Critical or High (source: Aave, Security). Umbrella had its own audits from MixBytes, StErMi, Ackee Blockchain, and Certora (source: Aave, Umbrella guide).
A long audit list still leaves room for error. Testing never finds every flaw in smart contract code, and an outside review only raises the chance of catching one. Code on a blockchain is hard to patch once it is live, and stolen funds are rarely recovered. Across the industry, value lost to smart contract defects is estimated at well over $1 billion (source: ethereum.org, Smart contract security).
Bug bounties pay people to report a flaw before anyone uses it. The Aave program on Immunefi has run since October 18, 2023. It pays a critical smart contract bug 10% of the funds directly at risk, with a floor of $50,000 and a cap of $1,000,000 (source: Immunefi, AAVE Bug Bounty). Critical bugs in the Aave V4 program on Sherlock earn up to 2,500,000 USD (source: Sherlock, Aave V4 Bug Bounty).
Aave promotes the same two programs with larger headline caps, up to $5M for the core program and up to $3.5M for V4 (source: Aave, Security). The figures differ, so read the program terms before you lean on either one. A bounty pays the person who finds the bug, and it does not repay a supplier if a bug is used first.
What the rsETH exploit showed about collateral risk
The rsETH exploit of April 18, 2026 showed Aave can work as designed and still face bad debt. An attacker used a forged bridge message to obtain rsETH, a liquid restaking token, and borrowed WETH against it on Aave. Aave's contracts were never compromised. The failure came from the collateral (source: LlamaRisk, rsETH Incident Report).
The flaw sat in Kelp's LayerZero bridge route from Unichain to Ethereum, which relied on a single verifier. A forged message released 116,500 rsETH to the attacker, and 89,567 of those tokens were deposited on Aave markets on Ethereum and Arbitrum to borrow WETH (source: LlamaRisk, rsETH Incident Report).
The Protocol Guardian moved within hours. It froze rsETH and wrsETH reserves across Aave V3 and set their loan-to-value to 0, so no one could open new loans against them. On April 20, it also froze WETH on several markets to keep the stress from spreading to other reserves, stablecoins included (source: LlamaRisk, rsETH Incident Report).
Nobody yet knew how Kelp would share the loss, so Aave's service providers modeled two outcomes. Spreading the loss across all rsETH holders gave an estimated $123.7 million of bad debt, most of it in the Ethereum Core WETH reserve. Limiting it to rsETH on layer 2 networks gave an estimated $230.1 million, all of it on those networks (source: LlamaRisk, rsETH Incident Report).
Umbrella could help only in part. Its WETH module held about 23,507 WETH, worth some $54 million, against the Ethereum Core shortfall in the first outcome. It covered Ethereum Core alone. Bad debt on layer 2 markets would need the DAO treasury, a recovery by Kelp, or a governance vote (source: LlamaRisk, rsETH Incident Report).
Aave counts more than $4.4 billion liquidated with zero bad debt (source: Aave, Security), and that record covers past liquidations, which cannot price the next collateral failure. A liquid staking or restaking token can carry another project's bridge risk, and when its backing breaks, the health factor math still runs on a price that is no longer true. Every pooled lender, Morpho as an Aave alternative included, carries this risk, because each one lends against collateral it does not control.
What to check before you supply or borrow on Aave
Before you supply or borrow on Aave, check the version and market you are in and the assets that market accepts as collateral. Then check how much of the pool is on loan and whether Umbrella covers your asset on that network. If you borrow, also check how much buffer your health factor has.
Start with the version and market. Aave V3 alone had 23 markets across 20 chains when the rsETH exploit hit (source: LlamaRisk, rsETH Incident Report). Each market has its own collateral list, oracles, and caps. A safety check on one market tells you little about the next, so repeat it each time you move funds.
As a supplier, your main risks are a wait to withdraw and bad debt in your reserve. Withdrawals come from funds that are not lent out, so when utilization, the share of deposits on loan, runs near the top, you may wait until borrowers repay or new deposits arrive. Look at the collateral list as well, since a weak asset there is how bad debt reaches the reserve you supplied.
As a borrower, your main risk is liquidation. You raise your health factor by adding collateral or by repaying part of the loan (source: Aave, Health Factor and Liquidations), and you do both from your own wallet, because an Aave loan is a self-custody position with no support desk to step in. Set a price alert on your collateral, and decide in advance at what level you will add funds.
Holding AAVE carries none of these pool checks, since the token's risk is its price and where you keep it. Buying AAVE on an exchange gives you the token with no health factor and no aTokens at all.
| Check | If you supply | If you borrow |
|---|---|---|
| Version and market | V3 or V4, and which market | The same, since rules differ by market |
| Collateral list | Which assets can create bad debt in your reserve | How your own collateral is priced |
| Pool on loan | How fast you can withdraw | How fast rates can rise |
| Umbrella | Whether your asset and network are covered | No cover for your own liquidation |
| Health factor | Matters only if your supply counts as collateral | Keep a buffer well above 1 |
Looking to trade AAVE tokens on BloFin? To get started, you'll need to first create a BloFin account, fund your account with cryptocurrency, then open the AAVE/USDT Spot trading page or the AAVEUSDT Perpetual page.
Frequently asked questions
Can a supply-only position on Aave lose money?
A supply-only position can lose money when its reserve takes bad debt, and it can be stuck when the pool is fully lent out. During the rsETH exploit, the WETH reserves on Ethereum, Base, Arbitrum, Mantle, and Linea were fully on loan, with idle balances under $20 on each chain. In the outcome where the loss was spread across all holders, Mantle's WETH reserve faced a 9.54% shortfall against its supply (source: LlamaRisk, rsETH Incident Report). That gap is a loss for the reserve's suppliers until a backstop or a recovery fills it.
Does Umbrella cover my collateral if I am liquidated?
Umbrella covers bad debt on the reserve side of a covered market, and it gives no cover to a position that uses that asset as collateral. If you are liquidated, the collateral you lose stays lost. The DAO treasury and the old staking modules are also outside Umbrella's coverage, and the DAO can change, pause, or end that coverage after a new risk review (source: LlamaRisk, Umbrella Coverage Principles). A paused module is no longer slashable, so any coverage during a pause has to go through a governance decision (source: LlamaRisk, rsETH Incident Report).
Is Aave V4 safer than Aave V3?
Aave V4 went live on Ethereum on March 30, 2026, after about 345 days of security review. That work drew on four audit firms and four independent researchers, along with a public Sherlock contest that ran six weeks and drew more than 900 verified participants. It opened with three liquidity hubs and conservative supply and borrow caps, which the DAO plans to raise as it watches live use (source: Aave Labs, Aave V4 is Live on Ethereum). Newer code with more review is a strong start, yet your safety still depends on the market, its collateral, and your health factor.
Can anyone freeze the crypto in my Aave position?
No central party can freeze or change an individual user's position on Aave, and the controls that do exist act on a whole reserve for risk management (source: Aave, Security). A reserve freeze stops new supply and new borrowing of that asset, while existing positions can still be repaid and can still be liquidated, which is how the rsETH and wrsETH freezes worked after the exploit (source: LlamaRisk, rsETH Incident Report). Your keys and your signed approvals stay under your control throughout.
What health factor is safe on Aave?
There is no single safe health factor, since the right level depends on how volatile your collateral and debt are and how closely they move together. A lower number can be reasonable when both sides are correlated, such as two stablecoins or ETH against a token tied to ETH. Tools such as DeFi Simulator let you test how prices change your number, and DeFi Saver can repay automatically, both at your own risk (source: Aave, Health Factor and Liquidations). Volatile collateral against a stablecoin loan needs the widest buffer.
Has the Aave Safety Module ever been slashed?
The legacy Safety Module has never carried out a slashing event in its history. Umbrella stakers who want out must wait through a 20-day cooldown and then a 2-day withdrawal window, and their stake can still be slashed during the cooldown (source: Aave, Umbrella guide). On March 23, 2026, governance cut the maximum slash on the stkABPT module (stkAAVE/wstETH BPTv2) from 10% to 0% (source: Aave Governance, AIP 459 Reduce Safety Module Emissions). Staking in Umbrella is a choice to take on slashing risk in return for rewards.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Primary sources include Aave's security, risks, Umbrella, and liquidation documentation, the LlamaRisk Umbrella coverage note and rsETH incident report on the Aave governance forum, Aave Labs' V4 launch post, the Immunefi and Sherlock bug bounty programs, and ethereum.org's smart contract security guide. All facts independently verified against cited documentation current as of October 2026.
This article is for informational and educational purposes only. It is not financial, investment, trading, or legal advice. Cryptocurrency can lose value. Borrowing on Aave can lead to liquidation if the health factor drops below 1. Spot AAVE/USDT buys the token. An AAVEUSDT Perpetual is a contract on the price. Do your own research. Consider your circumstances before using any protocol or trading any asset.