⚠️ What Happened

On March 10, 2026, the decentralized lending platform Aave experienced a technical oracle misconfiguration that triggered about $27 million in liquidations across the protocol. 

The issue wasn’t a hack or market crash. Instead, it came from a configuration mismatch in the CAPO risk oracle managed by Chaos Labs. 

🧠 The Technical Cause

The bug affected Wrapped Staked Ether (wstETH), a token that normally trades slightly above ETH because it accumulates staking rewards.

However, the CAPO oracle temporarily undervalued wstETH by about 2.85% compared with the real market price. 

This happened because:

• A snapshot timestamp and ratio parameter became unsynchronized
• Smart-contract limits prevented the ratio from updating fast enough
• CAPO computed a maximum exchange rate below the real market value

Result: the system thought collateral was worth less than it actually was, pushing borrowing positions below their liquidation thresholds. 

💥 What the Chain Reaction Looked Like

Once the incorrect price propagated through the protocol:

• 34 user positions were incorrectly liquidated
• Around 10,938 wstETH was forcibly sold
• Liquidator bots captured roughly 499 ETH (~$1M) in liquidation bonuses

All together, the event totaled about $27M in liquidations. 

📊 Important Detail: The Protocol Wasn’t Insolvent

Even though users were liquidated, the protocol itself remained financially healthy:

• No bad debt occurred on Aave
• The issue was purely a pricing configuration error
• The underlying market data and feeds were correct

This means the core lending system stayed solvent. 

💰 Compensation Plan

Chaos Labs acknowledged responsibility and announced that all affected users will be reimbursed.

The compensation plan includes:

• 141.5 ETH recovered after the incident
• Up to 345 ETH from the Aave DAO treasury to cover remaining losses

Developers also temporarily reduced borrowing limits for wstETH and manually fixed the oracle configuration. 

🧩 Why This Matters for DeFi

This incident highlights a core risk in decentralized finance:

Oracles = the single most fragile layer in DeFi.

Even when:

• smart contracts work correctly
• markets are stable
• no hackers are involved

…a pricing mismatch can still trigger millions in liquidations automatically.

It’s a reminder that automation in DeFi can execute perfectly — even when the input data is wrong.

✅ Quick Takeaways

• $27M in liquidations triggered on Aave
• Cause: CAPO oracle configuration mismatch
• Asset affected: wstETH undervalued ~2.85%
• 34 users liquidated incorrectly
• Liquidator bots earned ~499 ETH
• No bad debt for the protocol
• Users will be fully reimbursed