Until recently, lending stablecoins on Aave yielded 2.32% APY, despite the Federal Reserve's overnight rate being 3.64%. This discrepancy suggested that the market viewed DeFi as a lower credit risk than traditional investments. However, this perception was short-lived.
In a dramatic turn of events, the market repriced DeFi credit risk in real-time, prompting a significant shift in investor sentiment. The mispricing of DeFi credit risk became apparent when ranking dollar-credit options by yield.
Treasury overnight rates stood at 3.64%, while Ledn's investment-grade Bitcoin-backed ABS senior tranche yielded 6.84%, and Strategy's STRC perpetual preferred yielded 11.50%. In contrast, Aave's stablecoin lending rate was a mere 2.32%. This anomaly could not persist, and the market eventually corrected itself. Luca Prosperi had previously argued that DeFi stablecoin rates should carry a 250-400 basis-point premium over the risk-free rate, implying a yield of 6.15-7.76%.
The Bank of Canada's report, on the other hand, cited Aave's 0.00% non-performing loan rate as evidence of DeFi's ability to deliver defaultless lending. The exploit of Kelp DAO's LayerZero-powered cross-chain bridge on April 18th marked a turning point. An attacker minted approximately 116,500 unbacked rsETH tokens, worth around $292 million, and used them as collateral on Aave.
The resulting contagion was instant, with $6-10 billion in net outflows leaving Aave within 48 hours. Utilization on WETH, USDT, and USDC pools reached 100%, and depositors were unable to withdraw their funds.
Borrowers, in turn, were unable to source stablecoin liquidity. The aftermath saw Aave's stablecoin deposit APYs surge from 3-6% to 13.4% within two days. Morpho's USDC vault, which powers Coinbase's consumer loan product, jumped from 4.4% APR on April 18th to 10.81% the next day. The total DeFi TVL across the top 20 chains fell by more than $13 billion.
A key consequence of this event is the lack of bankruptcy law within DeFi protocols. If a user withdraws their funds first, they can keep everything. However, those who are last in line may absorb a disproportionate share of the losses. In contrast, regulated lenders have a legal duty to halt operations when they realize they cannot cover liabilities, and bankruptcy courts can claw back assets from parties who benefited unfairly.
The absence of a formal process in DeFi means that risk sizing becomes increasingly complex. If the total loss can be estimated but its distribution cannot be predicted, it becomes challenging to estimate individual exposure.
This uncertainty can lead to significant losses, depending on how quickly users move and how fast those around them react. The future of DeFi is unlikely to be risk-free, and the recent events serve as a reminder that permissionless markets have always carried a premium over their regulated equivalents.
As institutional allocators size their DeFi exposure for the coming year, they should take the recent signal seriously. The 2.32% Aave APR before the incident did not reflect the underlying risk, and the market has now adjusted.
While it is uncertain where DeFi rates will settle, one thing is clear: the mispricing is over, and the market has repriced DeFi credit risk accordingly.