Until last Friday, April 17, stablecoin lending to Aave, widely considered the gold standard of DeFi, yielded 2.32% APY. The Federal Reserve’s overnight rate was 3.64%. Taken at face value, the market valued an unregulated open source smart contract as having a lower credit risk than the U.S. Treasury.
In 48 hours, it’s over. The market did in real time what no regulator, auditor or commentator had managed to do: it reassessed DeFi credit risk.
Bad pricing
Rank dollar credit options by yield before last weekend, and the hierarchy made no sense. Overnight Treasury: 3.64%. Ledn’s Bitcoin-backed investment grade ABS senior tranche, priced in February at BBB-: 6.84%. Strategy preferred perpetual STRC: 11.50%. US credit cards: 21% versus a 4% default rate. And Aave, well below all that: 2.32%.
Something had to give. Luca Prosperi argued earlier this year that DeFi stablecoin rates should carry a premium of 250 to 400 basis points over the risk-free rate, implying 6.15 to 7.76%. The Bank of Canada’s April 2 report took the opposite view, citing Aave’s 0.00% non-performing loan rate as evidence that DeFi’s architecture delivers default-free lending through strict collateral requirements and price-based enforcement. So what does all this mean? Either DeFi had resolved credit risk or the market had stopped valuing it.
Only one side could be right. Last weekend we found out which one.
The problem 1/1
On April 18, an attacker exploited Kelp DAO’s LayerZero-powered cross-chain bridge to create approximately 116,500 unsupported rsETH tokens, or approximately 18% of the circulating supply, worth approximately $292 million. The synthetic tokens were transferred to Aave as collateral. The attacker borrowed between $190 million and $230 million in real assets against collateral that, at the relevant time, did not exist. Aave’s incident report acknowledged that the protocol worked as intended; the deficit is structural and not technical. Kelp and LayerZero have since publicly blamed each other for the 1/1 validator setup that made the exploit trivial.
The contagion was instantaneous. DeFi protocols are interoperable by design, and “loopback” – borrowing on one platform and redepositing the proceeds as collateral on another – means that a success on Aave is a success on anything built on Aave. Approximately 20% of Aave’s historical borrowing volume comes from recursive leverage. In 48 hours, $6-10 billion in net outflows left Aave. Utilization of WETH, USDT and USDC pools has reached 100%. The depositors could not withdraw. Borrowers were unable to secure stable liquidity. Stranded users borrowed an additional $300 million from their own locked stablecoin deposits at 75% LTV, often at a loss, just to access money.
Tariffs responded accordingly. The APYs of Aave’s stablecoin deposits increased from 3-6% before mining to 13.4% in two days. Morpho’s USDC vault, which powers Coinbase’s consumer lending product, rose from an APR of 4.4% on April 18 to 10.81% the next day as the liquidity rush took hold. Total DeFi TVL across the top 20 chains fell by over $13 billion.
No bankruptcy, no court, no recourse
Here’s the part that won’t make the headlines and that dispatchers need to understand.
There is no bankruptcy law in a DeFi protocol. If you withdraw first, you keep everything. If you’re among the last, you don’t – and you risk absorbing a disproportionate share of the losses. Regulated lenders have a legal obligation to stop operations as soon as they realize they cannot cover their debts, and bankruptcy courts can recover from parties who have benefited unfairly. The liquidations of Celsius, BlockFi and FTX were grueling, but creditors recovered the assets and those responsible were brought to justice.
In DeFi, there is no process. There is no court. There is no recovery. There is no one to hold accountable.
This has direct consequences on the size of the risks. If you can estimate the total loss but cannot predict how it will be distributed, you cannot estimate your own exposure. It might be zero. Maybe that’s all. It depends on how fast you moved and how fast the people next to you moved.
What happens next
DeFi is not going away. Architecture has real utility and permissionless markets have always existed, in all asset classes and in all eras. But they have never been risk-free and have always carried a premium over their regulated equivalents. The 48 hours following the April 17 incident reminded the market that the same rule applies on-chain.
Institutional allocators assessing DeFi exposure for the coming year should take the signal seriously. The Aave APR of 2.32% before last weekend did not reflect the underlying risk, and the market has now adjusted. It’s up to the market to decide where DeFi rates go from here. But the pricing errors are over. Last weekend proved it.
