Aave founder Stani Kulechov warned that DeFi lending protocols need circuit breakers, arguing that immutable code can leave systems unable to respond when oracle failures lead to liquidations. Speaking at DAS London on November 11, 2026, Kulechov said the fallout from an oracle failure could take years to unwind.
Oracle failures and liquidation risk
Lending protocols rely on oracles, the data feeds that tell smart contracts what an asset is worth. If those feeds go wrong, the protocol can make decisions based on prices that are not real. On a lending platform, those decisions include liquidations: when a borrower's collateral appears to fall below a safety threshold, the system sells it automatically to protect lenders.
Kulechov focused on systems that relied heavily on immutable code with no contingency plan. Immutable code cannot be changed once deployed, which is strong for trust but problematic when something breaks and no one is allowed to fix it.
A circuit breaker borrows from traditional markets, where exchanges halt trading during extreme moves. In DeFi, the concept would let a protocol stop the bleeding while humans investigate what went wrong.
Aave's 2026 stress tests
Kulechov's argument draws on Aave's experience in 2026. On March 10, a CAPO misconfiguration on Aave led to about $27 million in liquidations across 34 positions. The protocol did not end up with bad debt from the incident.
In April, a $292 million exploit of KelpDAO's LayerZero bridge set off an $8.45 billion deposit run on Aave within 48 hours. The Aave DAO ultimately required a rescue package of roughly $300 million.
Aave V4 and containment
Aave is working on its fourth version, known as V4, built around a hub-and-spoke architecture with stronger risk controls. The upgrade emphasizes modular risk isolation and adds the ability to freeze specific collateral lines to prevent contagion from spreading. Aave's on-chain lending market has seen over $30 billion in deposits, according to recent updates.
Governance trade-offs
Kulechov's position leans toward upgradeable code, at least where oracles and liquidations are concerned. His argument is less about abandoning decentralization and more about accepting that failures will happen. The key distinction in his framing is that preventing volatility is not enough; protocols also need responsive tools that can manage and reverse errors after they occur.
Still, every circuit breaker is also a lever, and levers need someone to pull them. That raises governance questions about who decides when to freeze a market, how quickly, and under what criteria.
