After KelpDAO’s hack, AAVE is in worse shape than you think

Author: Duo Nine

Translated and edited by TechFlow

I don’t think people realize just how dire Aave’s current situation is.

All core markets have hit 100% utilization—including $3 billion in USDT and $2 billion in USDC now locked up!

This means you cannot withdraw your funds.

A long post explaining why—and how we got here.

When the rsETH vulnerability occurred and Aave incurred bad debt, major players—including Justin Sun, MEXC Exchange, and other whales—immediately withdrew billions of dollars from Aave.

This instantly drained all available liquidity from critical core markets like ETH, USDT, and USDC. Those who withdrew first escaped; those who hesitated got stuck.

Initially, the ETH market hit 100% utilization—meaning you could no longer withdraw your ETH from Aave.

Worse still, it also meant the protocol could not process ETH liquidations if ETH’s price dropped—or crashed. If you can’t sell any ETH, you can’t liquidate to cover your debt obligations.

This increases Aave’s risk of generating further bad debt—a risk that grows continuously as its markets remain locked.

Nonetheless, users can still sell aETH/wETH tokens on Uniswap or similar aggregators at only a small loss. This remains the last exit route for ETH depositors on Aave.

USDT and USDC depositors have no such option. They’re trapped.

This is because Aave has lost over $6 billion in liquidity in the past 24 hours. As whales withdrew their funds, USDT and USDC markets also reached 100% utilization.

These markets are now locked too—funds frozen. Panic is spreading, and desperate measures are being taken in this crisis.

Some users have opted to borrow USDT/USDC against collateral, exiting other markets at a 10–25% loss (90–75% LTV). Essentially, they’re borrowing GHO/DAI/USDe against their locked USDT/USDC.

But as more liquidity leaves Aave, more markets hit 100% utilization—and become locked or frozen due to low liquidity. This is rapidly spreading across all available markets.

Luckily, crypto markets have been relatively stable today, so liquidation risk is minimal. But if conditions change, the billions of dollars in stablecoins and other assets locked on Aave will be unable to undergo liquidation—leading to even more bad debt for Aave.

If trapped users—or associated protocols—need access to their funds to prevent liquidations or perform other critical functions, they’ll face serious problems.

Moreover, no one wants to deposit (or provide liquidity) into these markets now, because your ETH, BTC, USDC/USDT could get stuck there—and no one knows for how long.

Any available liquidity that appears is instantly snatched up by bots racing to flee. As I write this, I watched $250,000 in USDC liquidity vanish within seconds.

Then there’s the bad debt issue.

Aave incurred over $200 million in bad debt via rsETH—an absolute hot potato. No one knows who will ultimately foot the bill.

If you haven’t removed your assets from Aave, you risk bearing part of that bill—in some form. Inability to access your funds is part of that risk.

The contagion is extremely high.

Many protocols and applications rely on Aave for yield-generating mechanisms. These protocols—and their users—are now also stuck, and may be forced to incur bad debt without cause.

October 10 marked a CEX-driven crash—a truly epic failure of DeFi risk mitigation.

Aave should never have introduced rsETH as collateral—certainly not at a scale of hundreds of millions of dollars—enabling hackers to borrow over $200 million in ETH after minting fake collateral.

Rumors circulating on X claim rsETH was added to Aave due to a conflict of interest involving a service provider (lobbying). If true, this represents a major failure of its governance structure (though hardly unprecedented).

The @KelpDAO team, which manages rsETH, now faces a tough decision: Who will actually pay for the $200 million exploit? Aave users? L2 rsETH users? Will everyone affected be forced to absorb losses to cover the shortfall?

Since initially announcing the rsETH market freeze following the vulnerability, the Aave team—and its founder Stani—have remained silent for over 20 hours.

They’re sitting on a massive problem, as the entire protocol is now at risk. Trust has eroded: Aave’s TVL is hemorrhaging billions, pushing all core markets to 100% utilization.

Perhaps some key players in the space will step in to provide liquidity and stabilize Aave’s markets before things deteriorate further.

I was lucky—I exited Aave early when I first caught wind of this. I’ve also pulled all my assets out of DeFi entirely and won’t touch any protocol for the next few weeks. The risk is simply too great—for just a few percentage points of yield.