As of last Friday, April 17, lending stablecoins to Aave, widely considered the gold standard of DeFi, was paying 2.32% APY. The Federal Reserve’s overnight interest rate was 3.64%. Taken at face value, the market was pricing an open source, unregulated smart contract as less of a credit risk than the US Treasury.
In 48 hours that was over. The market did in real time what no regulator, auditor, or commentator had managed to do: it repriced DeFi credit risk.
Poor pricing
If you were ranking dollar credit options by performance before last weekend, the hierarchy made no sense. One-day Treasury: 3.64%. Ledn’s investment grade Bitcoin-backed ABS senior tranche, listed in February at BBB-: 6.84%. Preferred perpetual strategy STRC: 11.50%. US credit cards: 21% vs. 4% default rate. And Aave, well below everything: 2.32%.
Something had to give. Luca Prosperi argued earlier this year that DeFi stablecoin rates should have a premium of 250 to 400 basis points over the risk-free rate, implying between 6.15 and 7.76%. The Bank of Canada’s April 2 report took the opposite view, citing Aave’s 0.00% non-performing loan rate as evidence that DeFi architecture delivers default-free lending through strict collateral requirements and price-based enforcement. So what does it all mean? Either DeFi had solved credit risk or the market had stopped pricing it.
Only one party could be right. Last weekend we found out which one.
The 1/1 problem
On April 18, an attacker leveraged Kelp DAO’s LayerZero-powered cross-chain bridge to mint approximately 116,500 unbacked rsETH tokens, approximately 18% of the circulating supply, worth around $292 million. The synthetic tokens were moved to Aave as collateral. The attacker borrowed between $190 million and $230 million in real assets with collateral that, when it mattered, did not exist. Aave’s incident report acknowledged that the protocol worked as designed; The deficit is structural, not technical. Kelp and LayerZero have since publicly blamed each other for the 1/1 validator setup that made the exploit trivial.
The contagion was instantaneous. DeFi protocols are interoperable by design, and “looping” (borrowing on one platform and re-depositing profits as collateral on another) means that a hit to Aave is a hit to everything built on top of Aave. Approximately 20% of Aave’s historical lending volume comes from recursive leverage. Within 48 hours, between $6 billion and $10 billion in net outflows left Aave. The utilization of the WETH, USDT and USDC pools reached 100%. Depositors could not withdraw money. Borrowers were unable to obtain liquidity from stablecoins. Stranded users borrowed another $300 million against their own locked stablecoin deposits at 75% LTV, often at a loss, just to access the cash.
Rates responded accordingly. The APY on Aave stablecoin deposits went from 3% to 6% before the exploit to 13.4% in two days. Morpho’s USDC vault, which powers Coinbase’s consumer lending product, jumped from 4.4% APR on April 18 to 10.81% the next day as the liquidity scramble spread outward. Total DeFi TVL across the top 20 chains fell by over $13 billion.
No bankruptcy, no court, no recourse
This is the part that won’t make the headlines and that allocators need to understand.
There is no bankruptcy law within a DeFi protocol. If you withdraw first, you keep everything. If it is among the last, it is not and may absorb a disproportionate share of the losses. Regulated lenders have a legal duty to stop operations the moment they realize they cannot cover their obligations, and bankruptcy courts can recover parties who unfairly benefited. The liquidations of Celsius, BlockFi and FTX were grueling, but creditors recovered assets and those responsible were brought before a judge.
In DeFi there is no process. There is no court. There is no recovery. There is no one to hold responsible.
This has direct consequences for the risk dimension. If you can estimate the total loss but cannot predict how it will be distributed, you cannot estimate your own exposure. It may be zero. That may be everything. It depends on how fast you moved and how fast the people next to you moved.
What happens next?
DeFi is not going away. The architecture has real utility and permissionless markets have always existed, in all asset classes and in all eras. But they have never been risk-free and have always commanded a premium over their regulated equivalents. The 48 hours after the April 17 incident reminded the market that the same rule applies on-chain.
Institutional allocators assessing DeFi exposure for the coming year should take the signal seriously. Aave’s APR of 2.32% before last weekend did not reflect the underlying risk and the market has now adjusted. The market will decide where DeFi rates stabilize from here. But price manipulation is over. Last weekend he proved it.
