The Aave lending protocol, a major player in the decentralized finance space, experienced a critical freeze after all its primary markets simultaneously reached 100% utilization, rendering users unable to withdraw substantial amounts of cryptocurrency. According to DeFi Warhold, this scenario signifies a complete depletion of available funds, effectively locking in approximately $5 billion in stablecoins, including USDT and USDC, due to insufficient liquidity to facilitate payouts. The crisis unfolded on April 18 following a significant exploit of the Kelp DAO rsETH bridge, amounting to $292 million.
The attacker leveraged forged cross-chain messages to mint unbacked rsETH, which was then used as collateral on Aave to borrow nearly $200 million in WETH. As news of the 'bad debt' spread, a panic-driven withdrawal dynamic ensued, resulting in the exit of $6.6 billion from the protocol within a 24-hour period. Aave founder Stani Kulechov responded to inquiries about the crisis by stating he had nothing useful to add. The situation is dire, with DeFi Warhold explaining that 100% utilization across all markets signifies a complete halt in liquidity availability for withdrawals, and the inability to process liquidations, thereby trapping $3 billion in USDT and $2 billion in USDC without a clear exit strategy.
Furthermore, the analyst warned that price fluctuations could exacerbate the bad debt without a mechanism for mitigation, placing the protocol in its worst possible scenario due to its inability to protect itself against additional bad debt when liquidations are unexecutable. Natalie Newson, a senior researcher at CertiK, concurred that Aave is in severe trouble, highlighting that 100% utilization not only indicates a lack of liquidity but also signifies the failure of the protocol's self-defense mechanisms. Newson emphasized that liquidations require liquidity to function; without it, undercollateralized positions cannot be closed, leading to an accumulation of bad debt that the protocol cannot recover from without external assistance.
The crisis underscores the interconnected risks within the DeFi ecosystem, where the failure of one component can have far-reaching consequences. Aave's risk framework had anticipated the scenario of 100% utilization, with former Risk Manager Alex Bertomeu-Gilles previously noting that at such levels, no liquidity remains, and the situation becomes problematic for depositors seeking to withdraw their funds.
The technical analyst Duo Nine was among the first to identify Aave's 100% utilization, noting that the crisis began with the rsETH exploit, which led to bad debt and prompted significant withdrawals by major players, eventually causing the USDT and USDC pools to also reach 100% utilization and become stuck with locked funds.