Aave’s is facing 100% utilization in all core markets. This means the lending protocol is in ‘serious trouble,’ says CertiK researcher. (Boitumelo/Unsplash)
What to know:
Aave, one of the largest decentralized lending platforms, has effectively frozen after its major markets hit 100% utilization, leaving users unable to withdraw roughly $5 billion in USDT and USDC.
The crisis stems from a $292 million exploit of the Kelp DAO rsETH bridge, which led to unbacked collateral on Aave, nearly $200 million in WETH borrowing, and a rapid bank-run that drained about $6.6 billion from the protocol in under 24 hours.
Security experts warn that with no liquidity for liquidations, Aave faces compounding bad debt and may be unable to recover without external support, highlighting how DeFi’s interconnectivity can turn a single bridge failure into a systemwide threat.
The crisis began April 18, following a $292 million exploit of the Kelp DAO rsETH bridge. The attacker used forged cross-chain messages to mint unbacked rsETH, which was then deposited into Aave as collateral to borrow nearly $200 million in WETH. As news of the “bad debt” spread, a classic bank-run dynamic took over, causing a total of $6.6 billion to exit the protocol in under 24 hours.
When asked for comment on the crisis, Aave founder Stani Kulechov told CoinDesk via WhatsApp: “I do not have anything useful to say.”
For a lending protocol to hit 100% utilization across all markets at once is the “equivalent of a full stop. It actually means no liquidity available for withdrawals. Liquidations can’t be processed” and therefore $3 billion in USDT and $2 billion in USDC “are stuck with no clean exit,’ DeFi Warhol said.
What’s worse, the analyst added, “if prices move, bad debt compounds with no mechanism to cover it.” DeFi Warhol said that this is the worst situation for a lending protocol to be in because “when liquidations cannot execute, the protocol has no way to protect itself against further bad debt.”
Aave is in serious trouble
Natalie Newson, a senior blockchain security researcher at CertiK, said that Aave is in serious trouble.
“100% utilization doesn’t just mean a lack of liquidity; it means the protocol’s self-defense systems are down.”
Liquidations require liquidity to work because without it, undercollateralized positions can’t be closed and bad debt just keeps piling up, leaving the protocol in a situation it will not be able to recover from without outside help, she said.
“Aave didn’t get hacked. It got stuck due to the fallout from someone else’s bridge failure, and that difference should worry everyone working in this area,” Newson said. “The KelpDAO exploit didn’t just affect one protocol; it put the entire DeFi system to the test at the same time.”
Newson agreed with DeFi Warhol that those who did nothing wrong are now left dealing with the risks. She also said that the interconnectivity that makes DeFi powerful is the same feature that turns a single point of failure into a large-scale disaster.
A known risk scenario
Aave’s risk framework explicitly anticipated 100% utilization, with former Aave Risk Manager Alex Bertomeu-Gilles saying in 2020 that at that level, “no liquidity is left” and the situation becomes “problematic” because depositors are unable to withdraw their funds.
“When the rsETH exploit happened and AAVE incurred bad debt, whales like Justin Sun, MEXC exchange, and others immediately withdrew billions from AAVE,” the analyst said. “Initially, the ETH market hit 100% utilization, meaning you could not withdraw your ETH from AAVE.”
That soon spread to USDT and USDC pools as over $6 billion in assets left the protocol within hours. “As whales took out their money, USDT and USDC also hit 100% utilization,” Duo Nine said.“These markets are now also stuck with money locked.”
