The aftershocks from Saturday’s KelpDAO hack are spreading through the stablecoin markets in ways that weren’t immediately obvious.
In the first 24 hours after the attack, users on Aave borrowed approximately $300 million against their tether deposits of stablecoin tether on the platform according to data from Chaos Labs.
The increase in borrowing is not a sign of demand; it is a sign that users cannot withdraw. With stablecoin pools maxed out, depositors are borrowing against their own funds at a loss just to access liquidity.
Think of it this way: Imagine a bank that refuses to process customer withdrawal requests. So, out of desperation, customers take out loans on these deposits. This credit creation is not healthy but a desperate move for liquidity.
“We are now seeing some negative secondary effects of illiquidity in Aave stablecoin markets,” said monetsupply.eth, the pseudonymous head of strategy at Spark, a rival DeFi lending platform. “With users unable to withdraw due to 100% leverage, there has been an increase of ~$300 million in USDT-backed loans over the past 24 hours since the rsETH exploit.”
To understand how a single exploit on KelpDAO ended up locking every stablecoin outlet on Aave simultaneously, you need to understand how the system is supposed to work – and exactly where it broke down.
What is Aave and how should it work
Aave is a decentralized finance (DeFi) protocol that enables users to lend and borrow cryptocurrencies without intermediaries. Think of it like a bank, except it runs entirely on code on a public blockchain with no human gatekeepers.
Users deposit assets into lending pools and earn interest. Others borrow from the same pools by pledging crypto-assets as collateral, which exceeds the loan amount. The system is designed to self-correct automatically through interest. When many people want to borrow, interest rates rise, making it more expensive to borrow and encouraging lenders to deposit more. When demand falls, prices fall.
The entire system operates on one core assumption: that there is always enough liquidity – enough assets in the pool – for lenders to withdraw their deposits when they want and for borrowers to liquidate their positions when they need to.
When that assumption breaks down, everything else breaks down with it. This is what happened after the KelpDAO exploit.
rsETH and the KelpDAO exploit
rsETH is a liquid re-depositing ether token issued by KelpDAO.
When you stake ether (ETH), you lock it up to help secure the Ethereum network in exchange for a return similar to earning interest on a bond. Some protocols issue a floating staking token (LST) that represents your staked ETH.
Redeployment goes a step further and reuses the assets already deployed to secure additional systems, effectively stacking dividend against dividend. In return, you receive a receipt token that represents your position. rsETH is one such receipt token and has been widely used as collateral throughout the DeFi world.
On April 18, an attacker manipulated KelpDAO’s bridge infrastructure to release 116,500 rsETH – about 18% of the token’s circulating supply, worth approximately $292 million. These fake, unbacked tokens were immediately deposited into lending protocols, mostly Aave, to lend real ETH and other assets such as wrapped ether (wETH) against them. Fake tokens in, real money out.
“To [borrowed] WETH is gone. The rsETH holding its place in the boxes is worth whatever an unsupported claim is worth – approaching zero on the L2 side where 20+ chains bridged the rsETH backed by a now empty mainnet lockbox,” said 0xyanshu, a pseudonymous crypto operator known for work around on-chain funding and risk.
Aave froze the rsETH markets on V3 and V4 within hours, with founder Stani Kulechov confirming that the exploit was external and Aave’s contracts were not compromised. That freeze stopped the bleeding. But it also set off the chain reaction that produced the $300 million increase in borrowing.
How $300 million in borrowing was created in a single day
When news of the exploit broke, whales and large funds pulled billions of dollars worth of cryptocurrencies out of Aave’s liquidity pools within hours. Because they moved first and in large numbers, their payouts drained cash pools.
“When the rsETH exploit happened and AAVE incurred bad debt, whales like Justin Sun, the MEXC exchange and others immediately pulled billions from AAVE,” analyst Duo Nine said in an explanation. “Initially the ETH market hit 100% utilization, meaning you couldn’t withdraw your ETH from AAVE.”
This quickly spread to USDT and USDC pools, raising their utilization rate to 100% as over $6 billion in assets left the protocol within hours. Each lending pool has a fixed amount of assets deposited by users. Once every dollar of these assets has been lent out, there is nothing left for payouts.
“That’s because AAVE has lost over $6 billion in liquidity in the past 24 hours,” Duo Nine wrote. “As whales took their money out, USDT and USDC also hit 100% leverage. Those markets are now stuck with money locked up as well.”
This is where the $300 million secondary borrowing began.
Trapped USDT and USDC depositors unable to simply withdraw their money reached for the only exit still available to them. They began by withdrawing loans from their locked deposits.
“Some users decided to borrow against USDT/USDC and exit through other markets with a loss of 10-25%,” explained Duo Nine. “Basically you are borrowing GHO/DAI/USDe against your locked USDT/C.” It was not a trading strategy.
It has been a desperate act to borrow against their own money at a loss and accept 75 cents on the dollar just to draw liquidity out of the system at all. Aave allows users to borrow up to 75% of the total loan-to-value (LTV) of their escrow collateral, depending on the asset and its risk parameters.
“With a max LTV of 75%, users with locked-in USDT deposits can take up to 3/4 of the value of their Aave position. But this ends up reducing liquidity in other markets, with the USDC and USDe markets now also at 100% leverage,” noted monetsupply.eth, the pseudonymous platform manager at DeFi, a lending competitor.
For anyone watching DeFi from the outside, the message is clear: “Decentralized” does not mean “risk-free.”
