Aftershocks from Saturday’s KelpDAO hack are spreading across stablecoin markets in ways that were not immediately obvious.
In the first 24 hours after the attack, Aave users borrowed approximately $300 million against their stablecoin tether deposits. on the platform, according to data from Chaos Labs.
Increased debt is not a sign of demand; It is a token that users cannot withdraw. With stablecoin funds maxed out, depositors are borrowing at a loss against their own funds just to access liquidity.
Think about it this way: Imagine a bank that refuses to process customers’ fiat deposit withdrawal requests. Then, out of desperation, customers take out loans against these deposits. This credit creation is not healthy, but rather a desperate measure in search of liquidity.
“We are now seeing some negative side effects of illiquidity in the Aave stablecoin markets,” said monetsupply.eth, the pseudonymous head of strategy at Spark, a rival DeFi lending platform. “Because users are unable to withdraw due to 100% utilization, there has been a ~$300 million increase in USDT collateralized loans in the last day since the rsETH exploit.”
To understand how a single exploit on KelpDAO ended up blocking all stablecoin outputs on Aave simultaneously, it is necessary to understand how the system is supposed to work and exactly where it was broken.
What is Aave and how is it supposed to work?
Aave is a decentralized finance (DeFi) protocol that allows users to lend and borrow cryptocurrencies without intermediaries. Think of it like a bank, except it runs entirely on code on a public blockchain, with no human gatekeepers.
Users deposit assets into lending pools and earn interest. Others borrow from those same funds by posting cryptoassets as collateral, which exceeds the loan amount. The system is designed to automatically self-correct through interest rates. When many people want to borrow, rates rise, making borrowing more expensive and encouraging lenders to deposit more. When demand falls, rates go down.
The entire system operates on a central assumption: that there is always enough liquidity (enough assets in the pool) for lenders to withdraw their deposits when they want and for borrowers to roll over their positions when they need to.
When that assumption collapses, everything else collapses with it. That’s what happened after the KelpDAO exploit.
rsETH and the KelpDAO exploit
rsETH is a re-stakeable liquid ether token issued by KelpDAO.
When you stake ether (ETH), you lock it up to help secure the Ethereum network in exchange for a return, similar to earning interest on a bond. Some protocols issue a liquid staking token (LST) that represents your staked ETH.
Restaking goes a step further, repurposing those already staked assets to secure additional systems, effectively stacking returns upon returns. In return, you will receive a receipt token that represents your position. rsETH is one such receipt token and has been widely used as collateral across the DeFi world.
On April 18, an attacker manipulated KelpDAO’s bridge infrastructure to release 116,500 rsETH, approximately 18% of the token’s circulating supply, worth approximately $292 million. These fake and unbacked tokens were immediately deposited into lending protocols, primarily Aave, to borrow real ETH and other assets like wrapped ether (wETH) against them. Fake tokens in, real money out.
“That [borrowed] WETH is gone. “The rsETH holding its place in the vaults is worth what an unsupported claim is worth – approaching zero on the L2 side, where 20+ chains were holding a bridged rsETH backed by a now-empty mainnet lockbox,” said 0xyanshu, a pseudonymous crypto trader known for working around on-chain finance and risk.
Aave froze the rsETH markets on V3 and V4 within hours, with founder Stani Kulechov claiming that the exploit was external and that Aave contracts were not compromised. That freezing stopped the bleeding. But it also triggered the chain reaction that produced the increase in debt of 300 million dollars.
How $300 million in loans materialized in a single day
When news of the exploit broke, whales and large funds withdrew billions of dollars in cryptocurrency from Aave’s liquidity pools within hours. Since they were the first to act and in large numbers, their withdrawals depleted the liquidity funds.
“When the rsETH exploit occurred and AAVE incurred bad debt, whales like Justin Sun, MEXC Exchange and others immediately withdrew billions from AAVE,” analyst Duo Nine said in an explanation. “Initially, the ETH market reached 100% utilization, meaning you could not withdraw your ETH from AAVE.”
This soon spread to the USDT and USDC pools, raising their utilization rates to 100% as over $6 billion in assets left the protocol in a matter of hours. Each loan pool has a fixed amount of assets deposited by users. When every dollar of those assets has been borrowed, there is nothing left to withdraw.
“That’s because AAVE lost over $6 billion in liquidity in the last 24 hours,” Duo Nine wrote. “As the whales took out their money, USDT and USDC also reached 100% utilization. These markets are now also stuck with money locked up.”
It was then that the increase in secondary debt of 300 million dollars began.
Trapped USDT and USDC depositors, unable to simply withdraw their money, sought the only exit still available to them. They began by obtaining loans from their blocked deposits.
“Some users decided to borrow against USDT/USDC and exit through other markets with a 10-25% loss,” Duo Nine explained. “You basically borrow GHO/DAI/USDe against your locked USDT/C.” It was not a commercial strategy.
It has been a desperate act of going into debt with your own money at a loss, accepting 75 cents on the dollar, just to extract some liquidity from the system. Aave allows users to borrow up to 75% of the total loan-to-value (LTV) ratio of their deposited collateral, depending on the asset and its risk parameters.
“With a maximum LTV of 75%, users with stuck USDT deposits can withdraw up to 3/4 of the value of their Aave position. But this ends up reducing liquidity in other markets, with the USDC and USDe markets now also at 100% utilization,” noted monetsupply.eth, the pseudonymous chief strategist at Spark, a rival DeFi lending platform.
For anyone looking at DeFi from the outside, the message is clear: “Decentralized” does not mean “risk-free.”
