Supplying coins to Aave is not the same as parking cash in a supervised bank account. You are lending into a DeFi protocol: borrowers put up collateral, you receive interest-bearing aTokens, and the whole machine runs on smart contracts, price oracles and governance votes. Aave’s own security pages list a long history of audits — including Trail of Bits, OpenZeppelin, Sigma Prime and Certora formal work — and that is genuinely better than an anonymous “earn 20% APY” site. It is still not a guarantee. The protocol itself has said no system can be treated as risk-free.
What can go wrong for a supplier? A bug or bad upgrade in the contracts. A stablecoin or collateral asset that depegs or gaps so hard that liquidations leave bad debt. An oracle that prints the wrong price. A pool so heavily borrowed that you cannot withdraw the size you want when everyone else rushes for the exit. Network, bridge and phishing risks sit on top: the wrong frontend, the wrong chain, or a malicious approval can empty a wallet even when Aave’s code is fine. There is a Safety Module that can slash staked AAVE to cover shortfalls — useful backstop, not a personal insurance policy.
If you still use it, stick to mature markets and well-known assets, treat the rate as payment for credit and protocol risk, and never put money you need next week into a withdrawable-only-when-the-pool-has-cash product. Phishing pages that paste the Aave logo are common; type the URL yourself. For how similar “lend and earn” pitches get twisted into scams elsewhere, see high-yield crowdlending risks.
If a “recovery desk” now offers to unlock frozen DeFi funds for a fee, start at Get help and read Fake recovery before you pay anyone.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.