Author: Curry, Deep Tide TechFlow
Decentralized finance has a core tenet: users' money is held in custody by code, and if something goes wrong, there's no need to seek redress from anyone.
Currently, AAVE, the largest lending protocol in DeFi, is organizing the entire industry to pool funds to cover losses.
In the early hours of April 23, Aave founder Stani Kulechov posted on X that he was going to put 5,000 ETH into a fund called "DeFi United", which was worth about $11.5 million at the time.
This money will be used to fill the hole.
Six days ago, a hacker exploited a vulnerability in the KelpDAO cross-chain bridge to create a batch of fake tokens without any collateral, used them as collateral on Aave, and borrowed nearly $200 million worth of real ETH. Aave is the largest lending protocol in DeFi, managing over $30 billion in user assets. After the news broke, whales and institutional users were the first to abscond, and within six days, Aave's total deposits evaporated by nearly $15 billion, with its core liquidity pool being emptied.
Those depositors who didn't abscond are now unable to withdraw their money. According to CoinDesk, the utilization rate of USDT and USDC liquidity pools once approached 100%.
Stani's tweet was worth pondering; he called Aave his "life's work." When a founder publicly uses that term, it usually indicates that things have become serious enough to warrant a statement.
Therefore, DeFi United is an industry rescue mechanism spearheaded by the founder of Aave. As of today, those who have publicly pledged funding include Ethereum staking protocol Lido, restaking protocol EtherFi, the Golem Foundation, and Mantle, a subsidiary of Bybit.
However, a closer look reveals that the aid to these five companies has not yet been fully provided.
Currently, it is confirmed that Stani himself contributed 5,000 ETH and the Golem Foundation contributed 1,000 ETH. Lido's proposal to allocate 2,500 stETH and EtherFi's proposal to contribute 5,000 ETH are both still in their respective DAO voting processes. Mantle's proposal of 30,000 ETH is a loan and is currently still in the planning stage within the governance forum.
Furthermore, Lido's proposal included a precondition: funding would only be allocated once a complete restoration plan was finalized. This means that if the total amount wasn't reached, funding might not be disbursed.
How big was the hole in KelpDAO before?
The hackers borrowed a total of approximately 99,600 ETH. The Arbitrum Security Committee froze 30,700 of them, leaving a shortfall of approximately 68,900 ETH, equivalent to about $160 million.
The total potential support from the five parties amounts to approximately 43,500 ETH, but there is still a shortfall of 25,000 ETH, which no one has claimed yet.
DeFi version of the "troubled asset rescue plan"
In September 2008, two weeks after Lehman Brothers collapsed, the U.S. Treasury Department launched something called TARP, short for Troubled Asset Relief Program . Simply put, when Wall Street caused trouble, the government stepped in to organize a group of financial institutions to contribute money to a pool to cover bad debts and prevent the entire system from exploding in a chain reaction.
DeFi United does almost the exact same thing as TARP in terms of structure.
If Aave's bad debts aren't addressed, the consequences won't be limited to Aave alone. The rsETH token is used as collateral by many DeFi protocols, and according to Aave's incident report, Aave itself holds approximately 83% of the total circulating rsETH.
If the peg to these assets cannot be restored, bad debts will spread like a contagious disease to all protocols that accept rsETH. According to Lido's proposal, users of the EarnETH yield vault alone could face forced liquidation losses of up to 9,000 ETH.
This is why competitors are also pouring money in. Lido and EtherFi aren't aligned with Aave; they also operate their own lending and staking businesses. But if rsETH completely de-pegs, their users and liquidity pools will suffer the same fate. Saving Aave is essentially saving themselves.
The logic behind the financial crisis is roughly the same. Goldman Sachs didn't agree to contribute to TARP because it liked Merrill Lynch; it was because Goldman Sachs wouldn't survive if Merrill Lynch collapsed. The contagious nature of the financial system dictates that if a "too big to fail" institution has a problem, everyone has to chip in.
However, we all understand the key differences.
TARP is backed by the U.S. Treasury and the Federal Reserve. The Treasury has the power to compel financial institutions to participate, and the Federal Reserve can inject unlimited liquidity.
No organization behind this DeFi United initiative has the power to force anyone to contribute funds. Lido's 2,500 stETH investment awaits a DAO vote, EtherFi's 5,000 ETH investment awaits a DAO vote, and Mantle's 30,000 ETH investment awaits governance discussions.
So DeFi or AAVE is currently in a situation where it needs a "rescue plan," but its rescue plan is a crowdfunding campaign. Whether DeFi United can succeed depends on the community vote of each participant, on whether they think it's worth spending their own money to fill someone else's hole.
This is probably the first time the crypto industry has reached this crossroads.
In the past, when DeFi protocols encountered problems, either the founding team had to pay out of their own pockets to fix them, or users would simply accept the losses and leave. Never before had competitors needed to sit down and jointly invest to save a shared systemic risk.
Is it my turn to pay again this time?
Whether DeFi United can ultimately raise the 68,900 ETH remains to be seen. But one thing is certain: regardless of the outcome, the person who will foot the bill for this hole has been chosen.
According to incident reports on the Aave governance forum, if the shortfall cannot be fully covered, the bad debt will be distributed among Aave depositors. Specifically, those who deposited WETH into Aave to earn interest may find that the money in their accounts has been discounted.
The report estimates that the size of the bad debt depends on how the losses from rsETH are distributed, ranging from a minimum of approximately $123 million to a maximum of $230 million.
What did these users do? They deposited some ETH and earned a few percent annualized return. They probably didn't know that KelpDAO would have problems, let alone that a cross-chain bridge used a message verification mechanism called LayerZero, which had security configuration issues.
But their money was used to pay off the ETH that the hackers had borrowed.
If all proposals are approved and all funds are in place, depositors may be able to withdraw their funds unscathed. If the funds are not raised, these depositors' deposits will be reduced, the extent of which depends on the size of the shortfall.
They have no voting rights on this matter. The depositors who actually bear the consequences have no voting button to press during this process.
According to CoinDesk, Circle's chief economist, Gordon Liao, has proposed an emergency solution at the Aave governance forum, suggesting raising the lending rate cap from 10% to 50% to attract new funds and alleviate the liquidity crunch with higher interest rates...
In other words, Aave's current strategy is to use more money to fill deeper holes.
Following the 2008 financial crisis, the world spent considerable time establishing various deposit insurance systems, stress tests, and systemic risk regulatory frameworks, all with one core objective:
This will prevent ordinary depositors from paying for the risky behavior of financial institutions.
DeFi has spent nearly 10 years building a system to bypass these regulations. But the pitfalls that the banking industry has learned over hundreds of years won't disappear just because you change your code. Bank runs, bad debt contagion, and innocent depositors being forced to pay the price—none of those problems will be absent.
As of press time, the available liquidity in the USDC pool on Aave is less than $3 million. If you're currently trying to withdraw your stablecoins from Aave's largest lending protocol, you're highly unlikely to succeed.
Whether it's DeFi or CeFi, hopefully this time it won't be ordinary people who foot the bill.
