Aave’s core markets hit 100% utilization at once, and that's not a good thing

Aave, one of the largest decentralized lending platforms, effectively froze Tuesday after all its major lending protocols ran out of available funds, leaving users unable to withdraw billions of dollars in crypto, DeFi Warhold said as he explained what the 100% utilization means.

Roughly $5 billion in stablecoins USDT and USDC are effectively locked, Warhold added, saying the protocol has no liquidity to pay out those assets .

The crisis began April 18, following a $292 million exploit of the Kelp DAO rsETH bridge. The attacker used forged cross-chain messages to mint unbacked rsETH, which was then deposited into Aave as collateral to borrow nearly $200 million in WETH. As news of the "bad debt" spread, a classic bank-run dynamic took over, causing a total of $6.6 billion to exit the protocol in under 24 hours.

When asked for comment on the crisis, Aave founder Stani Kulechov told CoinDesk via WhatsApp: “I do not have anything useful to say.”

For a lending protocol to hit 100% utilization across all markets at once is the “equivalent of a full stop. It actually means no liquidity available for withdrawals. Liquidations can’t be processed” and therefore $3 billion in USDT and $2 billion in USDC “are stuck with no clean exit,’ DeFi Warhol said.

What’s worse, the analyst added, “if prices move, bad debt compounds with no mechanism to cover it.” DeFi Warhol said that this is the worst situation for a lending protocol to be in because “when liquidations cannot execute, the protocol has no way to protect itself against further bad debt.”

Aave is in serious trouble

Natalie Newson, a senior blockchain security researcher at CertiK, said that Aave is in serious trouble.

“100% utilization doesn't just mean a lack of liquidity; it means the protocol's self-defense systems are down.”

Liquidations require liquidity to work because without it, undercollateralized positions can't be closed and bad debt just keeps piling up, leaving the protocol in a situation it will not be able to recover from without outside help, she said.

“Aave didn't get hacked. It got stuck due to the fallout from someone else's bridge failure, and that difference should worry everyone working in this area," Newson said. "The KelpDAO exploit didn't just affect one protocol; it put the entire DeFi system to the test at the same time.”

Newson agreed with DeFi Warhol that those who did nothing wrong are now left dealing with the risks. She also said that the interconnectivity that makes DeFi powerful is the same feature that turns a single point of failure into a large-scale disaster.