Decentralized lending giant Aave has effectively come to a standstill after its key lending protocols exhausted their available funds, leaving billions of dollars in cryptocurrency inaccessible to users. According to DeFi Warhold, roughly $5 billion in stablecoins, including USDT and USDC, are now locked within the protocol due to a lack of liquidity to facilitate payouts. The crisis unfolded on April 18 following a $292 million exploit of the Kelp DAO rsETH bridge, where an attacker utilized forged cross-chain messages to mint unbacked rsETH, which was then used as collateral on Aave to borrow nearly $200 million in WETH. This incident triggered a bank-run scenario, with $6.6 billion exiting the protocol within 24 hours.
When approached for comment, Aave founder Stani Kulechov stated he had nothing useful to add. DeFi Warhold explained that 100% utilization across all markets signifies a complete halt, with no liquidity available for withdrawals and liquidations unable to be processed, resulting in $3 billion in USDT and $2 billion in USDC being stuck without a clear exit strategy.
The situation is further complicated by the potential for bad debt to compound if prices fluctuate, with no mechanism in place to address it. This scenario is deemed the worst possible for a lending protocol, as it leaves the platform vulnerable to further bad debt without the ability to protect itself through liquidations.
Natalie Newson, a senior blockchain security researcher at CertiK, concurred that Aave is in serious trouble, emphasizing that 100% utilization not only indicates a lack of liquidity but also means the protocol's defensive mechanisms are inactive. Newson highlighted that liquidations require liquidity to function; without it, undercollateralized positions cannot be closed, and bad debt accumulates, placing the protocol in a situation from which it cannot recover without external assistance. The KelpDAO exploit, which did not directly hack Aave but caused it to become stuck due to the fallout, has raised concerns about the interconnectedness of DeFi systems, where a single point of failure can escalate into a large-scale disaster.
Aave's risk framework had anticipated the scenario of 100% utilization, with former Risk Manager Alex Bertomeu-Gilles noting in 2020 that at this level, no liquidity remains, and the situation becomes problematic for depositors seeking to withdraw their funds. Technical analyst Duo Nine was among the first to point out that Aave had reached 100% utilization, initially in the ETH market and subsequently in USDT and USDC pools, as over $6 billion in assets were withdrawn from the protocol within hours, leaving these markets stuck with locked funds.