DeFi's largest protocol, Aave's security team, has left. Who will withstand the next black swan event in the bear market?

Author: Deep Tide TechFlow

DeFi’s largest lending protocol is going through a silent exodus of its security team.

Yesterday, a company called Chaos Labs sent a farewell letter announcing the termination of its partnership with Aave. Most users probably haven’t heard of this name, but over the past three years, every loan-to-value ratio, liquidation threshold, and risk parameter for each borrowing and lending position you made on Aave was set by this company.

They also built an automated system called Risk Oracle. It can adjust parameters in real time as market conditions change. With this system, Aave expanded from dozens of markets to more than 250 markets across 19 chains. For three years, they managed pools worth hundreds of billions of dollars with zero bad debt.

In plain terms: smart contracts run on Aave, but the question of what numbers to fill into those contracts has always been something Chaos Labs kept in check.

Chaos Labs CEO Omer Goldberg’s farewell letter was written very professionally, and the track record he listed is also very detailed. TVL rose from $5.2 billion to over $25k, cumulative deposits exceeded 2.5 trillion, and liquidations exceeded $2 billion…

Then he said, “We proactively proposed terminating the agreement.” Nobody was “stirring up” anything about them, and the contract wasn’t even expired. Meanwhile, Aave founder Stani Kulechov responded very calmly, saying the protocol was operating normally, and that another risk service provider, LlamaRisk, would take over.

It sounds like nothing happened.

But in traditional finance, when a risk-management team that had been in charge for three years and never had an incident proactively leaves the largest DeFi lending protocol, that kind of thing is called an omen.

In the statement, Goldberg said the disagreement wasn’t about money—it was that the parties’ underlying risk-management philosophies no longer matched.

Less money, more resentment from the people

To keep people, Aave Labs proposed increasing Chaos Labs’ annual budget from $3 million to $5 million. Chaos Labs still left.

Goldberg listed three reasons in the statement that were “must-happen” reasons, but once you read them, you’ll realize they point to the same conclusion.

The first is money. Aave’s 2025 full-year revenue is $142 million, and the budget for risk management is $3 million—that’s 2%. Traditional banks typically spend 6% to 10% on compliance and risk management.

Goldberg said they’ve been losing money doing this for the past three years. Even if the budget is increased to $5 million, it’s still negative profit. He believes a reasonable bottom line is $8 million. Aave’s treasury has $140 million sitting in it. Aave Labs just approved a $50 million funding proposal for itself. So it seems the protocol isn’t short on money—it just doesn’t want to give the security team that much.

The second is “life.” Aave is upgrading from V3 to V4: the underlying architecture, contracts, and liquidation logic are all being rewritten from scratch. Goldberg said the only thing V4 and V3 share is the name. During the upgrade period, the two systems have to run in parallel. The risk team’s workload is not cut in half—it doubles.

The third is responsibility. The legal liability borne by DeFi risk-management personnel has not been defined at all. There’s no regulatory framework and no safe-harbor provisions. When things go smoothly, you’re invisible. When something goes wrong, you’re the first one they look for. Goldberg’s exact words were: “If the upside is marginal but the downside has no floor, then continuing to do this is inherently a terrible risk-management decision.”

The author finds it hard to refute that.

A protocol earning $140 million a year gives a team managing security for assets worth hundreds of billions only 2% of its budget. Then it tells them they need to do twice as much work for “life,” and once something happens, nobody legally protects them.

If it were you, would you do it?

Of course, the other side’s account is different. In his response on X, Aave Labs founder Kulechov suggested that Chaos Labs has actually been shrinking its risk-consulting business recently and has already started reducing cooperation with other protocols.

In other words, the reasons in the farewell letter are more like a dignified narrative to justify leaving.

Is it a mismatch of理念, or did they just use a convenient exit? Outsiders can’t tell. But one thing is certain: it’s not only Chaos Labs that left.

A bear market, with rain that falls through the night

Aave is still called Aave, but the people who built it have gradually cleared out over the past two months.

In February this year, BGD Labs—the core development team behind Aave V3—announced it would not renew its contract. Founded by Aave’s former CTO Ernesto Boado, this company basically did the V3 code, the governance system, and cross-chain deployments. They worked for four years, and when the contract expired, they left.

BGD’s reasons were very straightforward. Aave Labs is consolidating power in its own hands. Development for V4, brand assets, and social media accounts are all controlled by Aave Labs. BGD feels it has no right to participate in the design, yet it has to be responsible for the results. In traditional companies, this is called “disenfranchisement.”

One month later, ACI—the most active service provider in Aave’s governance system—also announced it was leaving. This team of eight helped drive 61% of Aave governance proposals over three years. In its farewell letter, founder Marc Zeller put it very directly, implying that Aave Labs can pass its own budget using its voting power, while independent service providers already have no meaning in this system.

Two farewell letters in two months: one says they were being sidelined, and the other says the game rules are unfair.

Then, in March of this year, another thing happened.

A risk-management system built by Chaos Labs had a configuration error, leading to the wrong liquidation of a position of about $27 million. At least 34 users were affected. Chaos Labs said it didn’t generate any bad debt, and that affected users would be compensated.

In the end, nobody took legal responsibility for it, because there is no legal definition in DeFi of who should bear responsibility.

But when you control hundreds of billions of dollars, and one parameter mistake can cause tens of millions in capital fluctuation—and your legal protection is essentially zero—that’s exactly the problem the risk team repeatedly emphasized in its farewell letter.

By this point, in the V3 era, Aave ran on four pillars: development, governance, risk management, and financial growth. Now all three of the first pillars have left.

In the risk team’s farewell letter, there’s a metaphor called the Ship of Theseus. If every plank on a ship is replaced, is it still the same ship?

The Aave name is still there, the contracts are still running, and TVL is still rising. But the teams that wrote the code are gone, the teams that manage governance are gone, and the teams that manage risk are gone. Users continue to deposit and borrow as usual, and they may not even realize that everything under the ship’s hull has already been replaced.

What truly makes people uncomfortable isn’t about who left. It’s that after they left, nothing happened.

Users open the page, deposit money, borrow money, interest rates look normal, liquidations look normal, everything is business as usual. Unless someone specifically reads the governance forums, most users won’t know what has happened over the past two months.

In the short term, it really may be fine. Smart contracts won’t shut down just because the risk team left. Pre-set parameters won’t magically change themselves. And Aave still has a risk service provider, LlamaRisk, so it’s not totally naked.

But risk management is not a one-time engineering project. Setting parameters correctly doesn’t mean they will always be appropriate. Markets change, assets change, and so do attack methods on-chain. Next time something similar happens, whether the incoming new team can react that quickly—nobody knows.

Besides, it’s not a calm period right now.

AAVE’s token price has fallen from its August last year high of $356 to around $96 now—a drop of more than 70%. The entire DeFi lending track is shrinking, on-chain activity is declining, and protocol revenue is under pressure.

In a bull market, risk management is invisible. Nobody claps because “nothing happened today.” In a bear market, risk management is truly needed—because asset prices swing violently, liquidation density rises, and the probability of black swan events increases. That’s exactly the stage where risk-management teams’ experience and responsiveness are most tested.

And at this stage, the people with the most experience are the ones who left.

In their farewell letter, the risk team said a line that the author thinks is very accurate. Aave has been able to beat those more aggressive competitors not because it has more features, but because when others blew up, it didn’t. In this market, surviving is the product.

Now the problem is that the people who helped it survive may already be gone.