The repercussions of Saturday’s KelpDAO hack are reverberating through stablecoin markets in unexpected ways.
In the 24 hours following the incident, users borrowed around $300 million against their tetherUSDT$1.0002 deposits on Aave, as per data from Chaos Labs.
This borrowing surge signals not a rise in demand but rather an inability to withdraw funds. With stablecoin pools saturated, depositors are forced to take loans against their own holdings at a loss merely to gain liquidity.
Imagine a scenario where a bank denies processing fiat withdrawal requests, prompting customers to secure loans using these deposits as collateral. Such credit creation is far from ideal but represents a desperate bid for liquidity.
“We’re witnessing negative secondary effects of illiquidity in Aave’s stablecoin markets,” noted monetsupply.eth, pseudonymously leading strategy at Spark, a competing DeFi lending platform. “Due to 100% utilization preventing withdrawals, borrowing with USDT collateral has surged by approximately $300 million since the rsETH exploit occurred.
To grasp how an isolated KelpDAO exploit led to simultaneous stablecoin exit locks on Aave, it’s crucial to understand both its intended operation and where it faltered.
Aave operates as a DeFi protocol, facilitating lending and borrowing of cryptocurrencies without intermediaries. It functions akin to a bank, entirely automated through blockchain code with no human intervention.
Assets deposited into pools earn interest, while borrowers post collateral exceeding their loan amounts from these pools. Interest rates self-adjust automatically: high demand raises rates, discouraging borrowing and encouraging deposits; low demand lowers them.
This system hinges on one pivotal assumption: sufficient liquidity in the pool for lenders to withdraw and borrowers to unwind positions as needed. The collapse of this assumption precipitated chaos post-KelpDAO exploit.
rsETH is a liquid re-staking ether token from KelpDAO, allowing users to secure Ethereum’s network by staking ETH for yield akin to bond interest. Liquid staking tokens (LSTs) represent such staked assets. Re-staking involves utilizing already-staked assets for additional systems, stacking yields further. rsETH serves as one of these receipt tokens and is widely used in DeFi.
On April 18, a hacker exploited KelpDAO’s bridge infrastructure to issue 116,500 rsETH—about 18% of its circulating supply, valued at roughly $292 million. These counterfeit tokens were swiftly deposited into lending protocols like Aave, exchanging them for actual ETH and assets like wrapped ether (wETH).
“That [borrowed] WETH is gone,” stated 0xyanshu, a pseudonymous crypto operator specializing in on-chain finance and risk management. “The rsETH holding its place in vaults is worth as much as an unbacked claim—approaching zero on the L2 side, where 20+ chains held bridged rsETH backed by now-empty mainnet lockboxes.” Aave swiftly froze rsETH markets V3 and V4 after confirming the external nature of the exploit. This action halted further issues but triggered a $300 million borrowing spike.
Following the exploit revelation, whales and large funds pulled billions from Aave’s liquidity pools within hours, draining them due to their early, substantial withdrawals.
“When the rsETH exploit occurred, causing bad debt for AAVE, whales like Justin Sun and MEXC exchange withdrew billions,” noted analyst Duo Nine. “The ETH market reached 100% utilization first, preventing withdrawals from AAVE, soon affecting USDT and USDC pools as well, driving their utilization to 100%.”
This sequence left every lending pool devoid of assets for withdrawal after $6 billion exited the protocol within hours.
Trapped depositors then resorted to borrowing against their locked funds.
“Some users opted to borrow GHO/DAI/USDe using their USDT/C as collateral, incurring a 10-25% loss,” explained Duo Nine. “This wasn’t a strategy but a desperate measure for liquidity extraction.” Aave permits borrowing up to 75% of the loan-to-value (LTV) ratio depending on asset risk.
“With a 75% max LTV, users with stuck USDT deposits can withdraw up to 3/4 of their Aave position’s value,” observed monetsupply.eth. “This has further strained liquidity in USDC and USDe markets, now also at 100% utilization.” For external observers, the lesson is evident: “Decentralized” does not equate to “risk-free.”