Inside the Microstructure of Aave Lending Markets

Coin Metrics State of the Network is an unbiased, weekly view of the crypto market informed by our own network (on-chain) and market data.

Key Takeaways

• The KelpDAO exploit stress-tested Aave’s lending markets, revealing how collateral risk can propagate across shared liquidity pools.
• Within hours, WETH borrow rates tripled and stablecoin supply yields spiked to over 10%, capturing a rapid shift in liquidity conditions in real time.
• Aave Horizon is extending onchain lending beyond crypto-native collateral, enabling stablecoin borrowing against tokenized RWA collateral from issuers like Superstate, VanEck, and Ripple.

Introduction

Lending markets are a core pillar of onchain finance, enabling borrowers to access liquidity and depositors to earn yield on idle assets. Protocols like Aave have evolved beyond the incentive-driven liquidity mining of DeFi’s early days, toward more sustainable models built on stablecoin growth, higher quality collateral, and risk management. Yet in April 2026, these markets absorbed their largest stress test. The fallout from the KelpDAO rsETH exploit rippled into Aave‘s WETH and stablecoin markets, triggering an onchain “bank run” that pushed utilization rates to 100% across major pools.

The episode surfaced the tradeoffs of composability, collateral selection and systemic leverage in pooled lending models, despite the risk originating entirely from external cross-chain bridge infrastructure. At the same time, the transparency of onchain lending markets offer an unprecedented view of how liquidity, rates, and participant behavior unfolded in real time.

In this issue of State of the Network, we dive into the microstructure of Aave’s core lending markets, and how liquidity reacted in real-time during the KelpDAO exploit. We also understand the emerging role of Aave’s Horizon markets in unlocking the use of tokenized real world assets (RWAs) as collateral in onchain lending.

Liquidity & Rates During the KelpDAO Exploit

Wrapped ETH (WETH) Gets Drained

On April 18th at approximately 17:38 UTC, the attacker deposited unbacked rsETH as collateral on Aave and borrowed approximately 126,000 WETH across four transactions. At this point, WETH market utilization (percentage of deposited assets that are borrowed) was already sitting near 89%, leaving only an 11% liquidity buffer to absorb any shock.

Available liquidity (amount of deposited capital that is unborrowed) in the pool collapsed from ~350,000 ETH to near zero within two hours, as the initial exploit was compounded by depositors rushing to exit. Simultaneously, utilization spiked to 100% and flatlined, trapping new withdrawals as every unit of ETH was borrowed.

Source: Coin Metrics ATLAS

The Rate Response

Aave’s interest rate model responded automatically to liquidity stress. As utilization crosses the optimal target or “kink point”, rates rise rapidly to discourage further borrowing and attract new deposits.

Before the exploit, WETH variable borrow rate sat at ~2.3% and supply APY at ~1.9%, a narrow and stable spread reflecting a healthy market. Once utilization hit 100%, the protocol’s rate model kicked in as WETH utilization target was set to 92%. Borrow APY jumped to ~8.7% and supply APY to ~7.4%, with spreads widening from 0.57% to 1.31%.

Source: Coin Metrics ATLAS, Talos Research

WETH is Aave’s most borrowed asset, primarily used in leveraged “looping” strategies that form the basis of many ETH vaults. These strategies often involve depositing liquid staking tokens (LSTs) or liquid restaking tokens (LRTs) like wstETH or rsETH as collateral, borrowing WETH against them, and recycling the proceeds back into more LST collateral to amplify staking yields. Recent research from Galaxy showed that Aave borrowing activity is heavily concentrated in ETH-linked collateral such as LSTs and LRTs while WETH serves as the primary borrowed asset.

Before the exploit, borrowing WETH at ~2.3% against a ~4% staking yield meant loopers earned a positive carry of ~1.7%. At 8.7% borrow rates, that flipped to a −4.7% loss, pushing leveraged positions underwater. Ultimately, the unbacked LRT collateral in the form of rsETH built up “bad debt” in the WETH market.

The Stablecoin Bank Run

While WETH dominates Aave’s borrowing activity, stablecoins form the protocol’s largest liquidity base. The WETH liquidity crunch quickly cascaded into stablecoin markets, triggering an “bank run” dynamic across major pools.

Source: Coin Metrics ATLAS

Depositors rushed to withdraw stablecoin liquidity, pushing utilization in USDT, USDC, USDe and other stablecoin markets to 100% as every available unit of liquidity was drawn down. In aggregate, over $2B in stablecoin liquidity was drained across major pools within 24 hours. USDT saw the fastest and largest withdrawals, with liquidity falling by over 60% within ~1.2 hours. USDC withdrawals were more gradual, draining available liquidity in ~11.4 hours.

Source: Coin Metrics ATLAS, Talos Research

Supply APYs that were previously in the 2–3% range spiked sharply as each pool hit 100% utilization. USDT and USDC both climbed to ~13%, DAI briefly exceeded 24% as the smaller pool hit its limits faster, and USDe oscillated as large positions shifted.

Cross Market Contagion: Pooled vs Isolated

The KelpDAO episode highlighted how collateral risk in one market can transmit across others in pooled lending. Unbacked rsETH concentrated stress in WETH, which cascaded into stablecoins through a shared scramble for liquidity.

Source: Coin Metrics ATLAS

The heatmap above shows how utilization rates across Aave v3’s core markets evolved over the exploit window. WETH and major stablecoin pools were already highly utilized (above ~80%) going into the incident. They were the first to be driven into sustained 90–100% utilization as the shock hit, while governance token markets remained largely unaffected throughout.

This revealed the trade-offs of the pooled model. Shared liquidity brings deep capital efficiency and composability, but it also means that stress in one market can propagate across the protocol. In comparison, isolated lending models used by protocols like Morpho result in more fragmented liquidity and rely on curator selection, but contain risks across a smaller surface area. With ~86% of circulating rsETH supplied to Aave alone, collateral concentration amplified the impact.

Post Exploit Market Snapshot

In the days following the exploit, liquidity began stabilizing as rates reached a new equilibrium. Total deposits on Aave v3 Core on Ethereum fell from $34.5B to $18.8B, while outstanding loans dropped from $13.8B to $7.9B. The decline occurred across stablecoins, ETH derivatives and Bitcoin markets, reflecting a general loss of confidence rather than withdrawal from any single asset class.

Source: Coin Metrics ATLAS, Talos Research

As of May 2026, markets continue to rebuild, with WETH liquidity rebounding to ~$620M and utilization rates across WETH, USDT, and USDC have stabilized in the 80–90% range. The $123M in bad debt created by the exploit has since been addressed through the community-led DeFi United initiative, which raised over $300M to backstop Aave’s markets.

Aave Horizon: Towards RWA Collateralized Borrowing

Beyond the core markets we covered, Aave is also evolving in a different direction. As more real world assets (RWAs) are tokenized, Horizon shows how lending markets may expand beyond crypto-native collateral into a more institutional form of onchain credit. Aave’s Horizon is a dedicated instance designed for institutional and qualified participants, enabling stablecoin borrowing against tokenized RWA collateral (i.e., tokenized money market funds, U.S. treasuries).

Horizon is built to support two types of users. Qualified institutional investors can supply RWA collateral and borrow stablecoins, while anyone can permissionlessly supply stablecoins to earn yield from institutional borrowers. This gives tokenized assets a more productive role onchain. Instead of simply sitting in custody, they can be used directly as collateral to access 24/7 liquidity without being sold.

Source: Aave Horizon Documentation

Assets utilized in these markets include Ripple’s RLUSD stablecoin, Superstate’s Crypto Carry Fund (USCC), Superstate Short-Duration Treasury Fund (USTB) and others including Janus Henderson’s JAAA and VanEck’s VBILL. Aave Horizon launched in August 2025 and has already grown to $510M+ in deposits, and $172M in total assets borrowed, making it one of the largest onchain RWA lending markets.

Source: Talos Research

While stablecoins like Ripple’s RLUSD and Aave’s GHO currently dominate deposits and borrows, Horizon is beginning to see meaningful supply into tokenized short‑duration Treasury and money market funds, laying the groundwork for RWAs to play a larger role in onchain credit.

‍

‍

‍

‍

‍

^{Disclaimer: The information herein is provided for informational purposes only. Talos Trading, LLC and its affiliates (“Talos”) does not give any representations or warranties in relation to the accuracy, validity, or completeness of the information of this material, including without limitation the factual information obtained from publicly available sources considered by Talos to be reliable at the time. Talos accepts no liability for any consequences of using the information contained in this material. Any opinions or estimates expressed herein reflect a judgment made by the author(s) as of the date of publication and are subject to change without notice. Neither this material nor any copy thereof may be taken, reproduced, or redistributed, directly or indirectly, without Talos’s prior written permission. Any views or opinions expressed are those of the authors and do not necessarily reflect the views of Talos. This communication does not constitute an offer to buy or sell, or a promotion or recommendation of, any digital asset, security, derivative, commodity, financial instrument, or product or trading strategy. This document and information are not intended to constitute investment advice or a recommendation to make (or refrain from making) any kind of investment decision and may not be relied on as such.}

Subscribe

If you’d like to get State of the Network in your inbox, please subscribe below.