Aave, one of the largest decentralized lending platforms, was effectively frozen on Tuesday after all of its major lending protocols ran out of available funds, leaving users unable to withdraw billions of dollars in crypto, DeFi Warhold said in explaining what 100% utilization means.
Around $5 billion worth of USDT and USDC stablecoins are effectively locked up, Warhold added, saying the protocol does not have the liquidity to pay for these assets.
The crisis began on April 18, following a $292 million exploit from the Kelp DAO rsETH bridge. The attacker used fake cross-chain messages to create uncollateralized rsETH, which was then deposited into Aave as collateral to borrow nearly $200 million in WETH. As news of “bad debt” spread, a classic bank flight dynamic took over, causing a total of $6.6 billion to exit the protocol in less than 24 hours.
When asked for comment on the crisis, Aave founder Stani Kulechov told CoinDesk via WhatsApp: “I have nothing useful to say.”
For a lending protocol to reach 100% utilization in all markets at once is “the equivalent of an end point. It effectively means no liquidity available for withdrawals. Liquidations cannot be processed” and therefore $3 billion in USDT and $2 billion in USDC “are stuck with no net outflow,” DeFi Warhol said.
Worse still, adds the analyst, “if prices change, bad debts worsen without any mechanism to cover them”. DeFi Warhol said this is the worst situation a lending protocol finds itself in because “when liquidations cannot be executed, the protocol has no way to protect itself against further bad debt.”
Aave is in big trouble
Natalie Newson, senior blockchain security researcher at CertiK, said Aave was in big trouble.
“100% utilization doesn’t just mean a lack of liquidity; it means the protocol’s self-defense systems are broken.”
Liquidations require liquidity to operate, because without it, undercollateralized positions cannot be closed and bad debts keep piling up, leaving the protocol in a situation from which it will not be able to recover without outside help, she said.
“Aave was not hacked. It got stuck because of the fallout from someone else’s bridge failure, and that discrepancy should worry everyone who works in this field,” Newson said. “The KelpDAO exploit didn’t just affect one protocol; it challenged the entire DeFi system at the same time.”
Newson agreed with DeFi Warhol that those who have done nothing wrong must now face the risks. She also said that the interconnectivity that makes DeFi powerful is the same functionality that turns a single point of failure into a full-scale disaster.
A known risk scenario
Aave’s risk framework explicitly called for 100% utilization, with former Aave Chief Risk Officer Alex Bertomeu-Gilles stating in 2020 that at this level, “there is no liquidity left” and the situation becomes “problematic” as depositors are unable to withdraw their funds.
Technical analyst and crypto author Duo Nine was the first to point out that Aave had reached 100% utilization.
“When the rsETH exploit happened and AAVE incurred uncollectible debt, whales like Justin Sun, the MEXC exchange and others immediately withdrew billions from AAVE,” the analyst said. “Initially, the ETH market was at 100% utilization, meaning you couldn’t withdraw your ETH from AAVE.”
This quickly spread to the USDT and USDC pools, as over $6 billion in assets left the protocol in a matter of hours. “As the whales withdrew their money, USDT and USDC also reached 100% utilization,” Duo Nine said. “These markets are now also blocked with blocked money.”
