Aave, one of the largest decentralized lending platforms, actually froze on Tuesday after all of its major lending protocols ran out of available funds, leaving users unable to withdraw billions of dollars in crypto, DeFi Warhold said as he explained what 100% leverage means.
About $5 billion in stablecoins USDT and USDC are effectively locked up, Warhold added, saying the protocol has no liquidity to cash out those assets.
The crisis began on April 18 following a $292 million exploit of the Kelp DAO rsETH bridge. The attacker used forged cross-chain messages to create unbacked rsETH, which was then deposited into Aave as collateral to borrow nearly $200 million in WETH. As the news of “bad debt” spreads, a classic bank-driven dynamic took over, causing a total of $6.6 billion to exit the protocol in less than 24 hours.
When asked for comment on the crisis, Aave founder Stani Kulechov told CoinDesk via WhatsApp: “I don’t have anything useful to say.”
For a lending protocol to hit 100% utilization across all markets at once is “equivalent to a period. It effectively means that there is no liquidity available for payouts. Liquidations cannot be processed,” and therefore $3 billion in USDT and $2 billion in USDC are “stuck with no clean exit,” DeFi Warhol said.
Worse, the analyst added, “if prices move, bad debt arises with no mechanism to cover it.” DeFi Warhol said this is the worst situation for a lending protocol to be in because “when liquidations cannot be completed, the protocol has no way to protect itself from further bad debt.”
Aave is in serious trouble
Natalie Newson, a senior blockchain security researcher at CertiK, said Aave is in serious trouble.
“100% utilization doesn’t just mean a lack of liquidity; it means the protocol’s self-defense systems are down.”
Liquidations require liquidity to function because without it, undersecured positions cannot be closed and bad debts keep piling up, leaving the protocol in a situation it will not be able to recover from without outside help, she said.
“Aave wasn’t hacked. It stuck because of the fallout from someone else’s bridge failure, and that difference should concern everyone working in this area,” Newson said. “The KelpDAO exploit didn’t just affect one protocol; it put the entire DeFi system to the test at the same time.”
Newson agreed with DeFi Warhol that those who did nothing wrong now face the risks. She also said that the interconnectedness that makes DeFi powerful is the same feature that turns a single point of failure into a large-scale disaster.
A known risk scenario
Aave’s risk framework expressly anticipated 100% utilization, with former Aave Risk Manager Alex Bertomeu-Gilles saying in 2020 that at that level there is “no liquidity left” and the situation becomes “problematic” because depositors are unable to withdraw their funds.
Technical analyst and crypto writer Duo Nine was the first to highlight that Aave had hit 100% exploitation.
“When the rsETH exploit happened and AAVE incurred bad debt, whales like Justin Sun, the MEXC exchange and others immediately pulled billions from AAVE,” the analyst said. “Initially the ETH market hit 100% utilization, meaning you couldn’t withdraw your ETH from AAVE.”
It quickly spread to USDT and USDC pools as over $6 billion in assets left the protocol within hours. “When whales took their money out, USDT and USDC also hit 100% leverage,” Duo Nine said. “These markets are also now stuck with money locked up.”
