Until last Friday, April 17, stablecoin lending to Aave, widely considered the gold standard of DeFi, reported 2.32% APY. The Federal Reserve’s overnight rate was 3.64%. Taken at face value, the market valued an unregulated open source smart contract as having a lower credit risk than the U.S. Treasury.
In 48 hours, it’s over. The market did in real time what no regulator, auditor or commentator had managed to do: it reassessed DeFi credit risk.
Bad pricing
Rank dollar credit options by yield before last weekend, and the hierarchy made no sense. Overnight Treasury: 3.64%. by Ledn Investment grade ABS backed by Bitcoin senior tranche, listed in February at BBB-: 6.84%. The strategy Favorite Perpetual STRC: 11.50%. US credit cards: 21% versus a 4% default rate. And Aave, well below all that: 2.32%.
Something had to give. Luca Prosperi discussed earlier this year that DeFi stablecoin rates should carry a premium of 250-400 basis points over the risk-free rate, implying 6.15-7.76%. The Bank of Canada April 2 report took the opposite view, citing Aave’s 0.00% non-performing loan rate as proof that DeFi’s architecture delivers default-free loans through strict collateral requirements and price-based enforcement. So what does all this mean? Either DeFi had resolved credit risk or the market had stopped valuing it.
Only one side could be right. Last weekend we found out which one.
The problem 1/1
On April 18, an attacker exploited Kelp DAO’s LayerZero-powered cross-chain bridge will create approximately 116,500 unsupported rsETH tokens, or approximately 18% of the circulating supply, worth approximately $292 million. The synthetic tokens were transferred to Aave as collateral. The attacker borrowed an estimated $190 million to $230 million in real assets against collateral that, when it mattered, did not exist. Aave Incident Report recognized the protocol worked as expected; the deficit is structural and not technical. Kelp and LayerZero have since publicly blamed each other for setting up the 1/1 validator which made the exploit trivial.
The contagion was instantaneous. DeFi protocols are interoperable by design, and “loopback” – borrowing on one platform and redepositing the proceeds as collateral on another – means that a success on Aave is a success on anything built on Aave. Approximately 20% of Aave’s historical borrowing volume comes from recursive leverage. Within 48 hours, 6 to 10 billion dollars net exits left Aave. Utilization of WETH, USDT and USDC pools has reached 100%. The depositors could not withdraw. Borrowers were unable to secure stable liquidity. Blocked users borrowed Another $300 million against their own stable deposits locked at 75% LTV, often at a loss, just to access cash.
Tariffs responded accordingly. The APYs of Aave’s stablecoin deposits increased from 3-6% before mining to 13.4% in two days. Morpho’s USDC vault, which powers Coinbase’s consumer lending product, sautéed from 4.4% APR on April 18 to 10.81% the next day as the rush for liquidity rippled outwards. Total DeFi TVL on top 20 channels fell of more than 13 billion dollars.
No bankruptcy, no court, no appeal
Here’s the part that won’t make the headlines and that dispatchers need to understand.
There is no bankruptcy law in a DeFi protocol. If you withdraw first, you keep everything. If you’re among the last, you don’t – and you risk absorbing a disproportionate share of the losses. Regulated lenders have a legal obligation to stop operations as soon as they realize they cannot cover their debts, and bankruptcy courts can recover from parties who have benefited unfairly. The liquidations of Celsius, BlockFi and FTX were grueling, but creditors recovered the assets and those responsible were brought to justice.
In DeFi, there is no process. There is no court. There is no recovery. There is no one to hold accountable.
This has direct consequences on the size of the risks. If you can estimate the total loss but cannot predict how it will be distributed, you cannot estimate your own exposure. It might be zero. Maybe that’s all. It depends on how fast you moved and how fast the people next to you moved.
What happens next
DeFi is not going away. Architecture has real utility and permissionless markets have always existed, in all asset classes and in all eras. But they have never been risk-free and have always carried a premium over their regulated equivalents. The 48 hours following the April 17 incident reminded the market that the same rule applies on-chain.
Institutional allocators assessing DeFi exposure for the coming year should take the signal seriously. The Aave APR of 2.32% before last weekend did not reflect the underlying risk, and the market has now adjusted. It’s up to the market to decide where DeFi rates go from here. But the pricing errors are over. Last weekend proved it.
