Aave TVL evaporates by $8 billion, losing its top DeFi spot: $5.1 billion in stablecoins stuck, Umbrella security model faces first stress test

📄Full Article· Automatically extracted by trafilaturaGemini 翻譯2474 words

A bridge vulnerability caused Aave to lose nearly $8 billion in TVL in a single day, forcing it to relinquish its title as the largest DeFi protocol and subjecting the Umbrella security model, introduced in 2025, to its most rigorous stress test yet—if reserves are insufficient to cover the $195 million in bad debt, stkAAVE holders will be the first to absorb the losses. (Context: The biggest DeFi incident of 2026: Kelp hacked for $292 million, Aave faces nearly $200 million in bad debt, and rsETH backing collapses.) (Background: Kelp DAO’s rsETH cross-chain bridge hacked for $292 million, triggering a chain reaction of freezes across Aave and Compound.) DeFiLlama data shows Aave’s TVL plummeted from $26.4 billion to $18.6 billion in a single day, evaporating nearly $8 billion—the largest single-day asset exodus for a DeFi blue-chip protocol since the Terra collapse in 2022. What caught the market's attention wasn't just the numbers, but the structural implications: Aave has fallen from its position as the largest DeFi protocol, surrendering a title it held for over two years. The AAVE token dropped from $112 to $89.5 in 25 hours, a decline of over 20%. The numbers are more direct than any language: the impact on Aave went beyond TVL figures. At the peak of the event, both the USDt and USDC pools on Aave v3 reached 100% utilization—in other words, over $5.1 billion in stablecoins were "effectively impossible to withdraw" unless new liquidity was injected or existing borrowers actively repaid their loans. This is not a technical description, but a liquidity crisis at the protocol level: depositors locked funds into Aave only to find they could not withdraw them within a specific time window. Lookonchain data further revealed the withdrawal path—MEXC pulled $431 million in a single transaction, followed by Abraxas Capital with $392 million. Together, these two withdrawals totaled over $800 million, marking the largest institutional-grade exit in this wave of outflows. The chain reaction spread simultaneously. Curve Finance, Ethena, and BitGo WBTC successively suspended the use of the LayerZero bridge; Aave proactively froze rsETH positions on v3 and v4, as well as wETH markets across Ethereum, Arbitrum, Base, Mantle, and Linea. SparkLend, Fluid, and Upshift were also affected. The TVL of the entire DeFi ecosystem fell from $99.5 billion to $86.3 billion after the event, a total evaporation of $13.2 billion. The true novelty of this incident lies not in the attack itself—the Kelp DAO LayerZero bridge vulnerability has been detailed in previous reports—but in the fact that it unexpectedly triggered a public examination of Aave’s core security architecture. In June 2025, Aave introduced an automated bad debt protection mechanism called Umbrella. The design logic is that users can stake assets to earn rewards, while these staked funds act as the first buffer when the protocol incurs bad debt. The selling point of this model is that it "automatically absorbs losses without the need for governance voting," and it was seen as an architectural upgrade over Aave’s older Safety Module. Now, Umbrella is facing a $195 million bad debt gap—the 116,500 rsETH ($293 million) stolen by the attacker was deposited into Aave v3 as collateral, used to borrow wETH, and then drained, leaving behind about $195 million in bad debt. The key question is simple: are Umbrella’s reserves sufficient? If not, the losses will be transferred to stkAAVE holders as designed—those users who staked AAVE to "earn rewards." This is not just a matter of financial risk, but a moment where the definition of risk is being rewritten: you thought you were here to earn yield, but the contract tells you that you are also the final buffer against losses. This shift offers an interesting contrast. A study released earlier this month by the Bank of Canada pointed out that Aave v3 had successfully shifted risk to "borrowers" through over-collateralization and automated liquidation mechanisms—borrowers bore the losses when liquidated, keeping lenders relatively safe. But this time, if Umbrella reserves are insufficient, the risk will be shifted to "stkAAVE holders" rather than borrowers. Aave’s path of risk socialization has quietly changed its target. rsETH is a liquid restaking token (LRT). The characteristic of such assets is that their value is anchored to underlying assets (ETH restaking positions), but their

Data Status✓ Full text extractedRead Original (動區 BlockTempo)

🔍Historical Similar Events· Keyword + Asset Matching6 items

2026-04-19

Aave records $6 billion TVL drop as Kelp hack exposes structural risk at DeFi lender

Similarity 180%關鍵字 defi/aave/tvl

2026-04-22

North Korea's Lazarus Group siphons $575 million in 18 days! Kelp and Drift compromised in succession, DeFi infrastructure layer becomes the new hunting ground

Similarity 170%關鍵字 defi/億美元同分類 zh

2026-04-21

Kelp DAO hack triggers "DeFi chain reaction": Aave faces potential bad debt of up to $230 million

Similarity 170%關鍵字 defi/aave同分類 zh

2026-04-21