Aave’s core markets hit 100% utilization at once, and that’s not a good thing

Aave, one of the largest decentralized lending platforms, effectively froze Tuesday after all its major lending protocols ran out of available funds, leaving users unable to withdraw billions of dollars in crypto, DeFi Warhold said as he explained what the 100% utilization means.

Roughly $5 billion in stablecoins $USDT and $USDC are effectively locked, Warhold added, saying the protocol has no liquidity to pay out those assets .

The crisis began April 18, following a $292 million exploit of the Kelp DAO rsETH bridge. The attacker used forged cross-chain messages to mint unbacked rsETH, which was then deposited into Aave as collateral to borrow nearly $200 million in WETH. As news of the “bad debt” spread, a classic bank-run dynamic took over, causing a total of $6.6 billion to exit the protocol in under 24 hours.

When asked for comment on the crisis, Aave founder Stani Kulechov told CoinDesk via WhatsApp: “I do not have anything useful to say.”

For a lending protocol to hit 100% utilization across all markets at once is the “equivalent of a full stop. It actually means no liquidity available for withdrawals. Liquidations can’t be processed” and therefore $3 billion in $USDT and $2 billion in $USDC “are stuck with no clean exit,’ DeFi Warhol said.

What’s worse, the analyst added, “if prices move, bad debt compounds with no mechanism to cover it.” DeFi Warhol said that this is the worst situation for a lending protocol to be in because “when liquidations cannot execute, the protocol has no way to protect itself against further bad debt.”

Aave is in serious trouble

Natalie Newson, a senior blockchain security researcher at CertiK, said that Aave is in serious trouble.

“100% utilization doesn’t just mean a lack of liquidity; it means the protocol’s self-defense systems are down.”

Liquidations require liquidity to work because without it, undercollateralized positions can’t be closed and bad debt just keeps piling up, leaving the protocol in a situation it will not be able to recover from without outside help, she said.

“Aave didn’t get hacked. It got stuck due to the fallout from someone else’s bridge failure, and that difference should worry everyone working in this area,” Newson said. “The KelpDAO exploit didn’t just affect one protocol; it put the entire DeFi system to the test at the same time.”

Newson agreed with DeFi Warhol that those who did nothing wrong are now left dealing with the risks. She also said that the interconnectivity that makes DeFi powerful is the same feature that turns a single point of failure into a large-scale disaster.

A known risk scenario

Aave’s risk framework explicitly anticipated 100% utilization, with former Aave Risk Manager Alex Bertomeu-Gilles saying in 2020 that at that level, “no liquidity is left” and the situation becomes “problematic” because depositors are unable to withdraw their funds.

Technical analyst and crypto author Duo Nine was the first to highlight that Aave had hit 100% utilization.

“When the rsETH exploit happened and $AAVE incurred bad debt, whales like Justin Sun, MEXC exchange, and others immediately withdrew billions from $AAVE,” the analyst said. “Initially, the $ETH market hit 100% utilization, meaning you could not withdraw your $ETH from $AAVE.”

That soon spread to $USDT and $USDC pools as over $6 billion in assets left the protocol within hours. “As whales took out their money, $USDT and $USDC also hit 100% utilization,” Duo Nine said.“These markets are now also stuck with money locked.”