The Aave lending protocol, one of the largest in the decentralized finance space, has effectively come to a standstill after all its major markets reached maximum capacity, rendering users unable to withdraw billions of dollars in cryptocurrency. According to DeFi Warhold, this 100% utilization signifies a complete depletion of available funds, resulting in a lack of liquidity to facilitate withdrawals or process liquidations.
Approximately $5 billion in stablecoins, including USDT and USDC, are currently locked within the protocol, with no clear exit strategy. The crisis unfolded on April 18, following a $292 million exploit of the Kelp DAO rsETH bridge, where an attacker utilized forged cross-chain messages to mint unbacked rsETH, which was then used as collateral to borrow nearly $200 million in WETH on Aave. As news of the 'bad debt' spread, a rapid exodus of funds ensued, with a total of $6.6 billion exiting the protocol within a 24-hour period. Aave founder Stani Kulechov declined to comment on the situation, stating he had 'nothing useful to say.' DeFi Warhold emphasized that 100% utilization across all markets is analogous to a complete halt, as it signifies a total absence of liquidity for withdrawals, and liquidations cannot be processed.
This has resulted in $3 billion in USDT and $2 billion in USDC being stuck with no viable exit strategy. Furthermore, the analyst warned that if market prices fluctuate, the 'bad debt' will compound, with no mechanisms in place to mitigate it. This situation is particularly dire, as the protocol is unable to protect itself against additional 'bad debt' when liquidations cannot be executed. Natalie Newson, a senior blockchain security researcher at CertiK, concurred that Aave is in a precarious position, stating that '100% utilization doesn't just mean a lack of liquidity; it means the protocol's self-defense systems are down.' Newson explained that liquidations require liquidity to function effectively, and without it, undercollateralized positions cannot be closed, leading to a perpetual accumulation of 'bad debt' that the protocol cannot recover from without external assistance.
The researcher noted that Aave's issues arose not from a direct hack, but from the repercussions of the KelpDAO exploit, which affected the entire DeFi ecosystem. Newson and DeFi Warhold both agreed that innocent parties are now shouldering the risks, and that the interconnected nature of DeFi, while powerful, also amplifies the potential for a single point of failure to escalate into a large-scale disaster.
Aave's risk framework had previously anticipated the possibility of 100% utilization, with former Aave Risk Manager Alex Bertomeu-Gilles warning in 2020 that at this level, 'no liquidity is left' and the situation becomes 'problematic' for depositors seeking to withdraw their funds. Technical analyst Duo Nine was the first to highlight Aave's 100% utilization, noting that following the rsETH exploit, large investors such as Justin Sun and MEXC exchange withdrew billions from Aave, initially causing the ETH market to reach maximum capacity.