Until April 17, lending stablecoins on Aave yielded 2.32% APY, despite the Federal Reserve's overnight rate being 3.64%. This mispricing implied that the market viewed an unregulated, open-source smart contract as a lower credit risk than the US Treasury.
However, this changed dramatically over 48 hours, as the market repriced DeFi credit risk in response to a significant exploit. The incident involved an attacker minting unbacked tokens and using them as collateral on Aave, resulting in an estimated $190-230 million in borrowed assets.
The protocol's incident report acknowledged that the issue was structural, not technical. The aftermath saw $6-10 billion in net outflows from Aave, with utilization on certain pools reaching 100% and depositors unable to withdraw.
Rates responded accordingly, with Aave stablecoin deposit APYs increasing to 13.4% within two days. The lack of bankruptcy law and recourse within DeFi protocols means that users who withdraw first keep everything, while those who are last may absorb a disproportionate share of losses. This has significant implications for risk sizing and exposure estimation. The market correction serves as a reminder that DeFi is not risk-free and carries a premium over regulated equivalents.
Institutional allocators should take this signal seriously when sizing DeFi exposure for the coming year.