There is a moment in every financial crisis when the thing everyone assumed was safe turns out to be the thing that breaks. For DeFi, that moment arrived this week. Aave, the largest decentralised lending protocol in crypto, has effectively frozen. All of its major markets hit 100% utilisation at the same time, meaning there is no liquidity left for anyone to withdraw. Roughly $5 billion in stablecoins is stuck with no clean exit.
When asked for comment on the crisis, Aave founder Stani Kulechov told CoinDesk: “I do not have anything useful to say.”
That might be the most honest thing anyone has said about DeFi all year.
How a Bridge Hack Broke the Biggest Lending Protocol in DeFi
Aave did not get hacked. That is the part that makes this scary. The protocol’s own smart contracts are working exactly as designed. The problem came from somewhere else entirely.
The crisis stems from a $292 million exploit of the Kelp DAO rsETH bridge, which led to unbacked collateral on Aave, nearly $200 million in WETH borrowing, and a rapid bank run that drained about $6.6 billion from the protocol in under 24 hours.
Here is what happened in plain terms. On April 18, an attacker exploited Kelp DAO’s bridge to mint 116,500 rsETH tokens that had no real backing. Those fake tokens looked legitimate to every protocol on the blockchain, including Aave. The attacker deposited the unbacked rsETH into Aave as collateral and borrowed roughly $200 million in real wrapped ETH against it. Then they disappeared with the borrowed ETH, leaving Aave holding collateral that was essentially worthless.
When word got out, everyone panicked. Users rushed to pull their funds from Aave before the bad debt could spread. Over $6.6 billion left the protocol in a single day. By the time the dust settled, every major lending pool was drained dry.
What 100% Utilisation Actually Means
If you have ever tried to withdraw money from a bank during a bank run, you understand what 100% utilisation feels like. There is nothing left in the vault.
CertiK senior blockchain security researcher Natalie Newson said that Aave is in serious trouble. “100% utilisation does not just mean a lack of liquidity; it means the protocol’s self-defence systems are down.”
That last part is the real problem. Aave has a built-in mechanism called liquidation that is supposed to protect the protocol from bad debt. When a borrower’s collateral drops in value, Aave automatically sells it to cover the loan. But liquidation requires liquidity in the pool. With utilisation at 100%, there is nothing left to sell. Bad positions cannot be closed. Bad debt just keeps piling up.
“Aave did not get hacked. It got stuck due to the fallout from someone else’s bridge failure, and that difference should worry everyone working in this area,” Newson said.
That distinction is crucial. Aave’s code is fine. Its security model is fine. What failed was the assumption that every asset deposited as collateral is actually worth what the blockchain says it is worth. When a bridge mints fake tokens and those tokens flow into a lending protocol as collateral, the protocol has no way to know the difference. It trusts the blockchain, and the blockchain was lied to.
The Numbers Are Brutal
Cumulative outflows from Aave across three and a half days totalled $15.1 billion. Total value locked contracted from $48.5 billion down to $30.7 billion.
That is a 37% decline in TVL in less than four days. AAVE’s governance token dropped to around $91, down roughly 23% from where it was before the hack. On-chain revenue fell from $1.1 million in early February to $625,000 as of Monday.
Aave’s incident report warned that bad debt across affected markets could reach between about $123.7 million and $230.1 million depending on how losses are ultimately handled.
That is the range. Best case, $124 million in losses. Worst case, $230 million. The final number depends on how Kelp DAO allocates the shortfall from its own hack and whether any of the stolen funds can be recovered.
The Contagion Effect
The damage did not stop at Aave. When $15 billion flows out of the largest lending protocol in DeFi, it has to go somewhere. Some of it went to competitors. SparkLend attracted $1.3 billion in fresh deposits, likely from the same large holders who pulled out of Aave. Morpho lost $1.5 billion in sympathetic withdrawals as users panicked about DeFi lending in general.
Dozens of protocols froze their LayerZero bridges as a precaution. Curve Finance, Ethena, ether.fi, and Tron DAO all paused cross-chain operations. DeFi’s total value locked dropped 7% across the entire sector to $86 billion, according to DefiLlama.
Ledger CTO Charles Guillemet said 2026 will “most likely be the worst year in terms of hacks.” After the Drift exploit ($285 million on April 1) and now the Kelp exploit ($292 million on April 18), first-quarter losses from crypto exploits have already crossed $600 million. We are not even through April.
What Happens From Here
Aave has a backstop mechanism called Umbrella that is designed to absorb bad debt automatically. It works by burning staked tokens to cover deficits. But Umbrella is only deployed on Ethereum’s main network and supports selected assets there. That means coverage is not uniform across every chain where Aave operates, which is a problem when the bad debt is spread across Ethereum, Arbitrum, Base, Mantle, and Linea.
The governance process is moving. Aave froze all rsETH reserves, set loan-to-value ratios to zero, and adjusted interest rate models across multiple chains. But these are containment measures, not solutions. The protocol still has billions in frozen stablecoins, an uncertain amount of bad debt, and a founder who says he has nothing useful to say.
For DeFi, the lesson from this week is uncomfortable but important. A single bridge failure on a protocol most people had never heard of managed to freeze the largest lending platform in decentralised finance. Not because Aave was poorly designed, but because the system is so interconnected that a vulnerability anywhere can become a crisis everywhere. That is the risk nobody in DeFi wants to talk about, and it just announced itself with $15 billion in withdrawals.
