Aave was hit by one of its sharpest liquidity shocks in years. Data from DeFiLlama shows the protocol’s TVL dropped from $26.4 billion to $18.6 billion in a single day, wiping out nearly $8 billion and costing Aave its position as the largest DeFi protocol after holding that title for more than two years. The AAVE token also fell from $112 to $89.5 within 25 hours, a decline of more than 20%.
Stablecoin pools hit full utilization, leaving $5.1 billion effectively unavailable
The damage went beyond headline TVL figures. At the peak of the event, Aave v3’s USDt and USDC pools both reached 100% utilization. In practical terms, more than $5.1 billion in stablecoins could not be withdrawn during that window unless fresh liquidity entered the pools or existing borrowers repaid their positions. That turned a market shock into a protocol-level liquidity freeze.
Lookonchain traced some of the biggest exits. MEXC withdrew $431 million in a single move, while Abraxas Capital pulled $392 million. Together, those withdrawals topped $800 million and stood out as the largest institution-sized exits in the broader outflow. The reaction spread across DeFi: Curve Finance, Ethena, and BitGo WBTC suspended use of the LayerZero bridge; Aave froze rsETH positions on v3 and v4 as well as wETH markets across Ethereum, Arbitrum, Base, Mantle, and Linea. SparkLend, Fluid, and Upshift were also affected. Across the sector, DeFi TVL fell from $99.5 billion to $86.3 billion, a drop of $13.2 billion.
$195 million bad debt puts Umbrella’s reserves under scrutiny
The key issue is not only the LayerZero bridge exploit tied to Kelp DAO, but the first live stress event for Aave’s Umbrella model, introduced in June 2025. Umbrella was built as an automated bad-debt protection mechanism. Users stake assets to earn rewards, and those staked funds are meant to absorb losses automatically if the protocol is left with bad debt, without waiting for a governance vote.
Aave now faces an estimated $195 million bad-debt hole. According to the source material, the attacker deposited 116,500 rsETH, worth about $293 million at the time, into Aave v3 as collateral, borrowed wETH, and left the protocol with the shortfall. The immediate question is whether Umbrella has enough reserves to cover the damage. If it does not, losses would be passed on to stkAAVE holders, the users who staked AAVE for yield.
That changes who stands at the end of Aave’s loss waterfall. Research released earlier this month by the Bank of Canada noted that Aave v3 historically relied on overcollateralization and automatic liquidation, leaving borrowers to absorb most of the pain. Under Umbrella, if reserves come up short, the burden can shift to stkAAVE holders instead.
LRT collateral exposes a wider bridge-dependent weakness
rsETH is a liquid restaking token, or LRT. Its value is tied to underlying ETH restaking positions, but its liquidity and security assumptions also depend on bridge infrastructure, message validation logic, and operational design. In this case, the exploited LayerZero bridge connected to Kelp DAO released 116,500 rsETH, giving the attacker access to what the report described as 18% of rsETH’s circulating supply.
The incident highlights a structural issue with LRT collateral. If bridge risk is not fully reflected in liquidation models, and the same asset is accepted by multiple lending protocols, one compromised bridge can become a transmission channel for losses and defensive freezes across the sector. The actions taken by Curve, Ethena, SparkLend, and Fluid show how quickly protocols moved to cut exposure to the same risk.
Questions grow after Chaos Labs’ exit
Aave defended its liquidation-driven safety design after the incident and said it remains central to protecting lenders. Still, the timing has drawn attention. On April 6, just two weeks earlier, Aave and long-time DeFi risk manager Chaos Labs formally parted ways over disagreements on v4 architecture and budget. Chaos Labs had long handled Aave’s risk parameter work, including liquidation thresholds for collateral assets.
Umbrella’s first encounter with real bad debt has now arrived just after that split. The market is not only repricing AAVE. It is also asking who is now responsible for monitoring Aave’s risk exposure after Chaos Labs stepped away.