Aave founder Stani Kulechov has a reminder for DeFi purists who hold "immutable code" as their highest creed: sometimes, you need a way to press pause.
On November 11, 2026, Kulechov said at the DAS London conference that DeFi lending protocols need to introduce a "circuit breaker." His reasoning: once an oracle fails, the consequences that follow may take years to digest.
The oracle that keeps Kulechov up at night
Lending protocols rely heavily on oracles, the data price feeds that tell smart contracts how much an asset is worth. Once the feed becomes blurred and distorted, the protocol makes decisions based on prices that are not real.
On lending platforms, such decisions include liquidations. When a borrower's collateral appears to fall below the safety threshold, the system automatically sells it off to protect lenders.
Kulechov's warning is mainly aimed at systems that rely heavily on immutable code and have no contingency plan whatsoever. Immutable code cannot be modified once deployed—good for building trust, but a disaster when something goes wrong and no one has the authority to fix it.
The circuit breaker is borrowed from traditional markets: exchanges pause trading under extreme conditions. In DeFi, the concept means letting the protocol stop the bleeding first, and then having humans figure out what exactly went wrong.
In 2026, a series of "stress tests" Aave went through
Kulechov is not speaking hypothetically. In 2026 alone, Aave has already personally experienced several of the scenarios he describes.
On March 10, 2026, a CAPO misconfiguration on Aave led to the liquidation of 34 positions, totaling about $27 million. The incident ultimately left no bad debt on the protocol.
Then came April. KelpDAO's LayerZero cross-chain bridge was exploited in a $292 million attack, triggering a deposit run of up to $8.45 billion on Aave within 48 hours.
The Aave DAO ultimately needed a bailout plan of about $300 million.
Aave V4 and the push for "stop-loss isolation"
Kulechov's remarks come as Aave advances its fourth version, V4. The upgrade is built around a "hub-and-spoke" architecture and is equipped with stronger risk control capabilities.
V4 emphasizes modular risk isolation and adds the ability to freeze specific collateral lines to prevent risk contagion from spreading.
According to recent updated data, deposits in Aave's on-chain lending market have exceeded $30 billion.
Revisiting the "immutability" debate
Kulechov's stance leans toward upgradeable code, at least in his attitude toward oracles and liquidations. His argument is not to abandon decentralization, but to acknowledge that failures will eventually happen.
The key distinction in his argument is this: merely preventing volatility is not enough; protocols also need responsive tools that can manage and correct course after errors occur.
What this means for DeFi lending
But there is a trade-off here. Every circuit breaker is also a lever, and someone always has to pull the lever.
This raises the governance question: who decides when to freeze a market, how quickly, and based on what criteria?
The events of 2026 add weight to Kulechov's argument: a misconfiguration in March wiped out dozens of positions, and an external attack in April triggered a multibillion-dollar run.
