An official postmortem traced the exploit to a LayerZero bridge verification failure and outlined a sweeping overhaul of Aave’s asset-listing standards as DeFi risks shift beyond smart contract bugs.