A $300M borrowing spike on Aave signals liquidity crunch after exploit

Markets Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email A $300M borrowing spike on Aave signals liquidity crunch after exploit The aftershocks of the Saturday's KelpDAO hack are spreading through stablecoin markets in ways that were not immediately obvious. By Omkar Godbole | Edited by Shaurya Malwa Apr 20, 2026, 9:27 a.m. Make preferred on Trapepd USDT deposits on Aave trigger large borrowing. (Boitumelo/Unsplash) What to know : A massive exploit of KelpDAO's rsETH token led an attacker to drain about $292 million in value, primarily by depositing unbacked tokens into Aave and borrowing real assets against them. In the 24 hours after the hack, whales rapidly pulled more than $6 billion from Aave, pushing major pools like ETH, USDT and USDC to 100 percent utilization and effectively trapping remaining depositors' funds. Stranded users then borrowed roughly $300 million against their own locked stablecoin deposits at steep losses, underscoring how a single DeFi exploit can freeze liquidity across multiple markets even when core protocol code remains intact. The aftershocks of the Saturday's KelpDAO hack are spreading through stablecoin markets in ways that were not immediately obvious. Int he first 24 hours post the attack, users on Aave borrowed approximately $300 million against their tether deposits of stablecoin tether USDT $ 1.0002 on the platform, according to Chaos Labs data. The borrowing spike isn’t a sign of demand; it is a sign users can’t withdraw. With stablecoin pools maxed out, depositors are taking loans against their own funds at a loss just to access liquidity. Think of it this way: Imagine a bank refusing to process customer fiat deposit withdrawal requests. So, out of desperation, customers take out loans on these deposits. This credit creation isn't healthy, but a desperate move for liquidity. "We're now seeing some negative secondary effects of illiquidity in Aave stablecoin markets," said monetsupply.eth , the pseudonymous head of strategy at Spark, a rival DeFi lending platform. "Because users can't withdraw due to 100% utilization, there has been a ~$300 million increase in borrowing with USDT collateral in just the past day since the rsETH exploit." To understand how a single exploit on KelpDAO ended up locking every stablecoin exit on Aave simultaneously, you need to understand how the system is supposed to work — and exactly where it broke. What is Aave and how it's supposed to work Aave is a decentralized finance (DeFi) protocol that enables users to lend and borrow cryptocurrencies without intermediaries. Think of it as a bank, except it runs entirely on code on a public blockchain, with no human gatekeepers. Users deposit assets into lending pools and earn interest. Others borrow from those same pools by posting crypto assets as collateral, which exceeds the loan amount. The system is designed to self-correct automatically through interest rates. When lots of people want to borrow, rates rise, making borrowing more expensive and encouraging lenders to deposit more. When demand falls, rates drop. The whole system operates on one core assumption: that there is always enough liquidity – enough assets in the pool – for lenders to withdraw their deposits when they want to, and for borrowers to unwind their positions when they need to. When that assumption breaks down, everything else breaks with it. That's what happened after the KelpDAO exploit. rsETH and the KelpDAO exploit rsETH is a liquid re-staking ether token issued by KelpDAO. When you stake ether (ETH), you lock it up to help secure the Ethereum network in exchange for a yield, similar to earning interest on a bond. Some protocols issue a liquid staking token (LST) that represents your staked ETH. Re-staking goes a step further, reusing those already-staked assets to secure additional systems, effectively stacking yield on yield. In return, you receive a receipt token representing your position. rsETH is one such receipt token and it has been widely used as collateral across the DeFi world. On April 18, an attacker manipulated KelpDAO's bridge infrastructure into releasing 116,500 rsETH — roughly 18% of the token's circulating supply, worth approximately $292 million. These fake, unbacked tokens were immediately deposited into lending protocols, mostly Aave, to borrow real ETH and other assets such as wrapped ether (wETH) against them. Fake tokens in, real money out. "That [borrowed] WETH is gone. The rsETH holding its place in the vaults is worth whatever an unbacked claim is worth — approaching zero on the L2 side, where 20+ chains held bridged rsETH backed by a now-empty mainnet lockbox," 0xyanshu, a pseudonymous crypto operator known for work around on-chain finance and risk, said . Aave froze rsETH markets on V3 and V4 within hours, with founder Stani Kulechov affirming the exploit was external and Aave's contracts were not compromised. That freeze stopped the bleeding. But it also set off the chain reaction that produced the $300 million borrowing surge. How $300 million in borrowing materialized in a single day When the exploit news broke, whales and big funds withdrew billions of dollars worth of cryptocurrencies from Aave's liquidity pools within hours. Because they moved first and in large numbers, their withdrawals drained liquidity pools. "When the rsETH exploit happened and AAVE incurred bad debt, whales like Justin Sun, MEXC exchange, and others immediately withdrew billions from AAVE," analyst Duo Nine, said in an explainer . "Initially, the ETH market hit 100% utilization, meaning you could not withdraw your ETH from AAVE." This soon spread to USDT and USDC pools, raising their utilization rates to 100%, as over $6 billion in assets left the protocol within hours. Every lending pool holds a fixed amount of assets deposited by users. When every dollar of those assets has been borrowed out, nothing remains for withdrawals. "That's because AAVE lost over $6 billion in liquidity in the past 24h," Duo Nine wrote. "As whales took out their money, USDT and USDC also hit 100% utilization. These markets are now also stuck with money locked." This is when the $300 million secondary borrowing surge began. Trapped USDT and USDC depositors, unable to simply withdraw their money, reached for the only exit still available to them. They began by drawing loans from their locked deposits. "Some users decided to borrow against USDT/USDC and exit via other markets at a 10-25% loss," Duo Nine explained. "Basically you borrow GHO/DAI/USDe against your locked USDT/C." It was not a trading strategy. It has been a desperate act of borrowing against their own money at a loss, accepting 75 cents on the dollar, just to extract any liquidity from the system at all. Aave allows users to borrow up to 75% of the total loan-to-value (LTV) of their deposited collateral, depending on the asset and its risk parameters. "With a 75% max LTV, users with stuck USDT deposits can take out up to 3/4 of the value of their Aave position. But this ends up reducing liquidity in other markets, with USDC and USDe markets now at 100% utilization as well," monetsupply.eth, the pseudonymous head of strategy at Spark, a rival DeFi lending platform, observed. For anyone watching DeFi from the outside, the message is clear: "Decentralized" does not mean "without risk." DeFi Crime Tether More For You Bitcoin, ether, solana slide, oil jumps on renewed U.S.-Iran war risks By Shaurya Malwa 3 hours ago Bitcoin traded at $74,335 after Iran reimposed controls on the Strait of Hormuz over the weekend, with the modest 1.6% pullback standing out against a 5.7% jump in Brent and a 1.2% drop in European equity futures. What to know : Bitcoin has proved more resilient than oil and equities to the latest Iran-related flare-up, slipping only modestly even as traditional markets reprice Middle East risk. The latest escalation, including renewed controls on the Strait of Hormuz and U.S. threats against Iranian infrastructure, has reversed a three-week unwind of war-risk premiums... Read full story Latest Crypto News Bitcoin, ether, solana slide, oil jumps on renewed U.S.-Iran war risks 3 hours ago LayerZero blames Kelp's setup for $290 million exploit, attributes it to North Korea's Lazarus 4 hours ago The $13 billion DeFi wipeout in two days, and it started with KelpDAO attack 4 hours ago Hack at Vercel sends crypto developers scrambling to lock down API keys 7 hours ago The $292 million Kelp exploit: how it happened, and what it means for DeFi 11 hours ago Previewing Consensus' Policy Summit: State of Crypto 14 hours ago Top Stories 'DeFi is dead': crypto community scrambles after this year's biggest hack exposes contagion risk 15 hours ago Bitcoin falls back to $76,000 as Iran shuts Hormuz again Apr 18, 2026 Aave sees $6 billion deposit drop as Kelp hack exposes structural risk for DeFi lender 18 hours ago Inside the rise of wrench attacks against crypto holders and how France has become the focus 19 hours ago RaveDAO's RAVE token collapses 90% in a day as exchange probes widen 19 hours ago