Aave Governance Crisis: The Exodus of Key Contributors and Systemic Risk in 2026

The four teams protecting the nearly 25,000 million dollars deposited in Aave as of April 2026 (17,870 million on September 17, 2026, according to DefiLlama) are gone. Chaos Labs, BGD Labs, Aave Chan Initiative, and Gauntlet —the architects of the security for the largest lending protocol in DeFi— left in just over two years (from February 2024 to April 2026). What remains is Aave Labs, alone, migrating to the most complex version in its history.

If you have funds in Aave, this affects you directly. Not because the smart contracts have failed, but because the people who oversaw them, who adjusted the risk parameters, who detected vulnerabilities before they became exploits —they are no longer there.

September 17, 2026 Update: all four exits have been finalized. The BGD Labs contract expired on April 1 and its $200,000 security retainer matured on June 1; ACI closed its Frontier staking program on April 18; Chaos Labs has not appeared in any DAO proposal since then. LlamaRisk remains the sole risk provider: the DAO renewed its mandate on Snapshot (May 7-10, 343,225 votes in favor and 0 against) and approved, also without a single vote against, its risk framework for V3, V4, and Horizon (July), the activation of Risk Stewards in V4 (September 6 Snapshot; execution not yet recorded), and the offboarding of six V3 deployments —Sonic, Scroll, zkSync, Metis, Soneium, and Aptos— and 49 reserves, via on-chain vote (AIP 521) since September 16. "Aave Will Win" was ratified on-chain on April 12. V4 has been operating on Ethereum since March 30 and was deployed on Avalanche (July 15) and Arc, Circle's L1 (September 16); as of September 17, DefiLlama attributes $480 million in TVL to it, compared to $17,010 million in V3. Total TVL stands at $17,870 million (DefiLlama, Sep-17-2026 15:51 UTC), down 29% from $25,140 million on April 10; the bulk of the decline followed the rsETH exploit and the DeFi United bailout ($14,320 million on April 25). Protocol revenue in 2026 through September 17 totals $57.0 million (DefiLlama, "revenue"; $124.2 million in 2025 using the same metric, which differs from the 142 million cited below).

What is happening with Aave's governance in 2026?

The Aave ecosystem is experiencing the deepest institutional crisis in its history. Between February 2024 and April 2026, the four external teams that underpinned the protocol's development, risk management and governance abandoned their positions. This is not a routine change of service providers: it is a total reconfiguration of the operational architecture of the world's largest DeFi lending protocol.

The pattern is unambiguous. Every team that left denounced the same dynamic: progressive centralization of power in Aave Labs, the protocol's founding entity. What began as a federated ecosystem with multiple independent voices —where productive tension between teams produced more conservative risk parameters— has transformed into a model where a single entity controls the technical, budgetary and strategic direction.

Who left Aave and why?

The disintegration of the external contributor team has followed a sequence that industry analysts describe as a process of "covert privatization." Each departure removed a layer of independent oversight, and each one strengthened Aave Labs' position as the central authority.

The loss of BGD Labs is particularly devastating from a technical standpoint. The team was founded by Ernesto Boado, the former CTO of Aave. BGD was not just any external provider: it was the custodian of the V3 codebase and the cross-chain security verification infrastructure. Losing BGD means losing the institutional memory of those who built the version that held, as of April 2026, some 25,000 million dollars in deposits. It is as if the architect of a skyscraper abandoned the project just before adding 20 more floors.

The departure of Gauntlet in 2024 was the first warning sign. After leaving Aave, it migrated to Morpho Blue —a clear signal that the best risk teams were choosing the competition. But it was an isolated case the community was able to absorb. What followed was a chain collapse.

Why did Chaos Labs leave Aave?

The departure of Chaos Labs on April 6, 2026 is the definitive turning point. For three years, Chaos Labs was the architect of Aave's economic stability, overseeing TVL growth from $5B to over $26B with a material bad debt rate of zero. That is an impeccable track record that few teams in DeFi can match.

But Chaos Labs operated at a loss during those three years. Its annual budget was $5M —the amount the DAO was willing to pay— against a minimum operational cost of $8M. Chaos subsidized Aave's security with its own capital for 36 months, waiting for a budget alignment that never came.

Omer Goldberg, CEO of Chaos Labs, identified three irreconcilable factors:

Chaos Labs argued that a protocol with $26B in deposits and $142M in revenue was spending less on security than a fintech startup spends on compliance. The DAO chose to save $3M annually and lost the team with the best risk management track record in all of DeFi.

Why do they accuse Aave Labs of centralizing power?

BGD Labs and ACI pointed directly at Aave Labs for concentrating decision-making. The accusations are not abstract —they are backed by documented on-chain facts and public DAO votes.

The CowSwap scandal (December 2025). It was discovered that Aave Labs had been diverting fees from the CowSwap collaboration into its own corporate treasury instead of depositing them into the DAO treasury. This is not a minor accounting error: when the entity receiving the largest DAO budget also diverts revenues belonging to the DAO, institutional trust breaks down. This event was the direct catalyst that led ACI to conclude that no viable role remained for independent service providers.

The brand assets vote. BGD Labs proposed transferring web domains, social media accounts and intellectual property rights to the DAO —a basic decentralization step that would guarantee the protocol did not depend on a single entity for its online presence. The proposal was rejected with 55% of votes against. Marc Zeller denounced that the vote was influenced by the large AAVE token holdings of entities linked to Aave Labs —that is, Aave Labs used its voting weight to block a transparency measure that would limit its own control.

Undisclosed voting power. Marc Zeller (ACI) articulated the core problem: it makes no sense to have independent service providers when the recipient of the largest DAO budget exercises undisclosed voting power over its own funding proposals and those of its competitors.

What is Aave V4 and why is it risky?

The departure of the risk and development teams occurs precisely as Aave deploys its most complex update: V4, in production on Ethereum since March 30, 2026. This version introduces a "hub-and-spoke" architecture that unifies liquidity across all networks, improving capital efficiency but creating a dangerous new vector: a failure in any spoke can drain the global liquidity of the hub.

The problem is not just the complexity of V4 itself. It is that V3 and V4 will coexist during a migration period that could last years. This means dual market management: risk oracles must process twice the data and anticipate interactions between old and new liquidity. Without the accumulated expertise of Chaos Labs and BGD Labs, the protocol faces an "institutional memory void" that could delay its response to oracle manipulation attacks or liquidity crises.

Chaos Labs' concern was not only technical but philosophical: V4's infrastructure was not designed with their input. They were being asked to assume responsibility for a system they had no part in designing and which they considered inherently harder to secure than V3.

What happened with the $50 million incident at Aave?

The fragility of the ecosystem during the transition became apparent on March 12, 2026, with a spectacular loss that reverberated across all of Crypto Twitter. A user attempted to swap 50.4 million aEthUSDT for aEthAAVE through the Aave interface. The result: they received $36,000 in assets —a 99.93% loss of value.

What went wrong? The CoW Swap aggregator integrated into the interface selected routing paths with insufficient liquidity for an operation of that magnitude. But the loss did not stop there: an MEV (Maximal Extractable Value) bot executed a sandwich attack that captured an additional $10 million from the transaction's inefficiency. Of the original ~$50M, $36K went to the user, ~$10M to the MEV bot, and the rest evaporated in extreme slippage.

This event is a brutal reminder that security in DeFi is not limited to smart contracts. Interfaces, aggregators and liquidity routes are attack surfaces requiring constant oversight —precisely the kind of oversight the teams that just left were providing.

Who manages Aave's risk now?

Following the departure of Chaos Labs, LlamaRisk has emerged as the successor for the protocol's risk management (mandate renewed by the DAO on Snapshot on May 10, 2026). With a team of 16 professionals, LlamaRisk proposes a fundamental paradigm shift: moving from a "delegated management" model —where external firms make decisions using opaque methodologies— to one of "protocol-owned risk infrastructure."

LlamaRisk's main criticism of Chaos Labs' previous approach is that it operated as a "black box": private methodologies, proprietary models, and decisions the DAO had to accept without the ability to audit the underlying reasoning. LlamaRisk proposes building tools on top of the Chainlink (CRE) infrastructure that are fully auditable and controllable by the DAO.

LlamaRisk's approach —open infrastructure vs. black box— is philosophically attractive. But the transition occurs under extreme pressure. LlamaRisk must absorb Chaos Labs' functions, become familiar with the risk parameters of dozens of markets across multiple chains, and prepare for the dual management of V3+V4, all simultaneously. Building institutional expertise takes years; the protocol needs results in months.

Oracle monitoring, parameterization of new assets and automatic safeguards such as LlamaGuard NAV are the immediate priorities. But the real test will come with the first market crisis under their supervision —an event that tends to arrive without warning.

Can Aave lose its dominant position in DeFi?

Aave remains the giant of DeFi lending, but internal instability is feeding the competition. Protocols such as Morpho and Spark have seized on the governance crisis to attract both talent and capital.

The most revealing example: Gauntlet, after leaving Aave in 2024, migrated to Morpho Blue. When the best risk teams choose your competitor, it is a signal the market does not ignore. If BGD Labs engineers end up building for another protocol, the talent exodus will become a capital exodus.

The previous "two-layer risk" model —where Gauntlet and Chaos Labs frequently held divergent opinions— forced debates that resulted in more conservative and robust parameters. That productive tension was a feature, not a bug. The current consolidation under Aave Labs and a single risk partner (LlamaRisk) could accelerate decisions, but also increase vulnerability to shared errors of judgment or group bias.

What does this mean for Aave users?

For users with funds deposited in Aave, the situation calls for active vigilance but not panic. V3's smart contracts continue to function as designed. However, there are practical considerations that can protect your capital:

Monitor the migration to V4. The coexistence of V3 and V4 introduces complexities that even the departing teams considered difficult to manage. LlamaRisk published its risk framework for V3, V4, and Horizon in June 2026, and the DAO approved the activation of Risk Stewards on V4 via Snapshot (September 6, 2026). Early adopters assume disproportionate risk during this phase.

Diversify across protocols. Concentrating all deposits in a single protocol during a governance transition period increases risk. Evaluate alternatives such as Morpho, Compound or Spark as complements —not replacements, but layers of diversification.

Use verified interfaces. The $50M incident demonstrated that interfaces can be vectors of massive loss. Use Aave's official interface, enable Aave Shield to limit price impact on swaps, and never execute large-scale operations without verifying available liquidity on the route.

Watch parameter adjustments. With a new risk team in charge, changes to collateralization factors, liquidation thresholds and lending limits deserve special attention. A calibration error in V4 could trigger cascade liquidations across hundreds of protocols that depend on Aave as a liquidity layer.

With CleanSky you can monitor your DeFi positions in real time and assess the health of your deposits in Aave and other lending protocols.

Conclusion: The end of an era in DeFi governance

The exodus of Aave contributors represents the most significant transformation in the governance of a blue-chip DeFi protocol. The shift from a multi-specialist federated model —where the tension between independent teams produced better decisions— to a "sovereign company" model under Aave Labs is a high-stakes bet with 25.000 million dollars at stake as of April 2026.

Aave has demonstrated technical resilience for years. The question is no longer whether the technology works, but whether an organization that has lost its most experienced guardians —the former CTO and his development team, the risk manager with a perfect 3-year track record, the ecosystem's most vocal governance leader— can maintain the discipline needed to safeguard assets of this magnitude during the most complex migration in its history.

The next 12 months will determine whether the consolidation of power in Aave Labs was a necessary measure for institutional scale or the beginning of a decline caused by the erosion of its decentralized character. The market will watch every parameter adjustment in V4. In a volatile asset environment, survival itself is the most valuable product —and Aave has just lost the guardians who secured that survival for the past three years.