Aave, one of the largest decentralized lending platforms, effectively froze on Tuesday after all of its major lending protocols ran out of available funds, leaving users unable to withdraw billions of dollars in cryptocurrency, DeFi Warhold said while explaining what 100% utilization means.
About $5 billion worth of USDT and USDC stablecoins are effectively locked up, Warhold added, saying the protocol has no liquidity to pay for those assets.
The crisis began on April 18, following a $292 million exploit of the Kelp DAO rsETH bridge. The attacker used forged cross-chain messages to mint unbacked rsETH, which was then deposited into Aave as collateral to borrow nearly $200 million in WETH. As news of the “bad debt” spread, a classic bank run dynamic took hold, causing a total of $6.6 billion to exit the protocol in less than 24 hours.
When asked for comment on the crisis, Aave founder Stani Kulechov told CoinDesk via WhatsApp: “I have nothing useful to say.”
For a lending protocol to reach 100% utilization across all markets at once is the “equivalent of an endpoint. In reality, it means that there is no liquidity available for withdrawals. Liquidations cannot be processed” and therefore $3 billion in USDT and $2 billion in USDC “are stuck without a clean exit,” DeFi Warhol said.
What’s worse, the analyst added, “if prices move, bad debt worsens without any mechanism to cover it.” DeFi Warhol said this is the worst situation a lending protocol can find itself in because “when settlements cannot be executed, the protocol has no way to protect itself against further bad debt.”
Aave is in serious trouble
Natalie Newson, senior blockchain security researcher at CertiK, said Aave is in serious trouble.
“100% utilization doesn’t just mean a lack of liquidity; it means that the protocol’s self-defense systems are down.”
Liquidations require liquidity to function because without it, unsecured positions cannot be closed and bad debts continue to accumulate, leaving the protocol in a situation from which it will not be able to recover without outside help, he said.
“Aave was not hacked. It was stuck due to the consequences of someone else’s bridge failure, and that difference should concern everyone who works in this area,” Newson said. “The KelpDAO exploit didn’t just affect one protocol; it tested the entire DeFi system at the same time.”
Newson agreed with DeFi Warhol that those who did nothing wrong now have to face the risks. He also said that the interconnectivity that makes DeFi powerful is the same characteristic that turns a single point of failure into a large-scale disaster.
A known risk scenario
Aave’s risk framework explicitly provided for 100% utilization, and former Aave risk manager Alex Bertomeu-Gilles said in 2020 that at that level “there is no liquidity left” and the situation becomes “problematic” because depositors cannot withdraw their funds.
Technical analyst and cryptocurrency author Duo Nine was the first to highlight that Aave had reached 100% utilization.
“When the rsETH exploit occurred and AAVE incurred bad debt, whales like Justin Sun, the MEXC exchange and others immediately cashed out billions of AAVE,” the analyst said. “Initially, the ETH market reached 100% utilization, meaning you could not withdraw your ETH from AAVE.”
That soon spread to the USDT and USDC pools, as more than $6 billion in assets left the protocol in a matter of hours. “As whales cashed out, USDT and USDC also reached 100% utilization,” Duo Nine said. “These markets are now also stagnant with money blocked.”
