The market is not good; may you be safe.
On November 3rd, Balancer suffered the most severe attack in its history, with $116 million stolen.
Just 10 hours later, another seemingly unrelated protocol, Stream Finance, began to experience abnormal withdrawals. Within 24 hours, its issued stablecoin, xUSD, started to decouple, plummeting from $1 to $0.27.
If you think this is just a story of two independent protocols having bad luck, you are mistaken.
According to on-chain data, **approximately $285 million in *DeFi* loans are using xUSD/xBTC/xETH as collateral**. From Euler to Morpho, from Silo to Gearbox, almost all mainstream lending platforms have exposure.
Worse still, Elixir's deUSD stablecoin has 65% of its reserves ($68 million) exposed to Stream's risk.
This means that if you have deposits on any of the aforementioned platforms, hold related stablecoins, or have provided liquidity, your funds may be experiencing a crisis you are not yet aware of.
Why did the hack of Balancer create a butterfly effect that triggered issues for Stream? Are your assets at risk?
We attempt to help you quickly clarify the negative events of the past two days and identify potential asset risks.
The Balancer Butterfly Effect: xUSD Decouples Due to Panic
To understand the decoupling of xUSD and the potentially affected assets, we need to clarify how these two seemingly unrelated protocols became fatally linked.
First, after the theft from the long-established DeFi protocol Balancer yesterday, hackers made off with over $100 million. Due to the variety of assets in Balancer, the news spread, causing panic throughout the entire DeFi market.
(For further reading: 5 years, 6 incidents, losses exceeding 100 million, the history of Balancer being hacked)
Although Stream Finance is not directly related to Balancer, its decoupling stems from the spread of panic and bank runs.
If you are not familiar with Stream, you can simply understand it as a DeFi protocol seeking high yields; its method of seeking high returns is through "circular nesting":
In simple terms, it repeatedly uses user deposits as collateral to amplify investment scale.
For example, if you deposit $1 million, Stream will use that $1 million to collateralize and borrow $800,000 from platform A, then take that $800,000 to collateralize and borrow $640,000 from platform B, and so on. Ultimately, your $1 million could be leveraged to a $3 million investment scale.
According to Stream's own data, they have amplified $160 million of user deposits to $520 million in deployed assets through this method. This more than threefold leverage can generate enticing high returns when the market is stable, attracting a large number of yield-seeking users.
However, high returns come with high risks. When news of Balancer being hacked spread, the first reaction of DeFi users was: "Is my money still safe?"
A large number of users began to withdraw from various protocols. Stream's users were no exception; the problem is that Stream's funds may not be in their own hands.
Through circular nesting, funds are layered and embedded in various lending protocols.
To meet users' withdrawal requests, Stream needs to unwind these positions layer by layer, such as first repaying the loan on platform C to retrieve the collateral, then repaying platform B, and finally platform A. This process is not only time-consuming but may also face liquidity exhaustion during market panic.
What’s worse, just at the critical moment when users were frantically withdrawing, Stream Finance released a shocking statement on Twitter: an "external fund manager" managing Stream's funds reported that approximately $93 million in assets were missing.
Users were already in a panic to withdraw, and now there was a nearly $100 million funding gap.
Stream stated in the announcement that they have hired top law firm Perkins Coie to investigate, and this announcement seemed very official, but it did not mention how the money went missing or when it could be recovered.
Such vague explanations will not wait for the investigation results. When users discover withdrawal delays, a bank run will ensue.
xUSD, as the "stablecoin" issued by Stream, should have been pegged to $1. But when everyone realized that Stream might not be able to fulfill its promises, a wave of selling ensued. From the night of November 3rd to today, xUSD has already dropped to around $0.27, severely decoupling.
Thus, the decoupling of xUSD is not a technical failure but a collapse of confidence. The crypto market is declining, and Balancer being hacked is just the fuse; the real bomb may be Stream's own high-leverage model, or even common issues among similar DeFi protocols.
Asset Checklist You Need to Check
The collapse of xUSD is not an isolated incident.
According to Twitter user YAM's on-chain analysis, there are currently about $285 million in loans using Stream-issued xUSD, xBTC, and xETH as collateral. This means that if these stablecoins and collateral assets go to zero, the entire DeFi ecosystem will feel the shockwave.
If you don't understand the principle, you might want to look at the following analogy:
Stream issues three types of "IOUs" through your deposited stablecoins like USDC:
xUSD: equivalent to "I owe you dollars"
xBTC: equivalent to "I owe you bitcoins"
xETH: equivalent to "I owe you ethers"
Under normal circumstances, for example, if you take xUSD (the dollar IOU) to the Euler platform and say: this IOU is worth $1 million, I will use it as collateral to borrow $500,000.
But when xUSD decouples:
xUSD drops from $1 to $0.3, meaning your "million" in collateral is actually only worth $300,000; but since you can borrow $500,000, that means Euler is at a loss of $200,000.
In simple terms, this is more like a bad debt, and ultimately, DeFi protocols like Euler will have to fill the hole. But the problem is, most of these lending protocols may not be prepared for such a scale of bad debt.
Worse still, many platforms use "hard-coded" price oracles, which do not determine collateral value based on real-time market prices but rather based on "book value."
This can avoid unnecessary liquidations caused by short-term fluctuations during normal times, but now it has become a ticking time bomb.
Even if xUSD has dropped to $0.3, the system may still consider it worth $1, leading to risks that cannot be controlled in a timely manner.
According to YAM's analysis, the $285 million in debt is distributed across multiple platforms, managed by different "Curators" (fund managers). Let's take a look at which specific platforms are sitting on this powder keg:
- ### The Biggest Victim: TelosC - $123.6 million
TelosC is the largest fund manager, managing two major markets on Euler:
Ethereum Mainnet: lent out $29.85 million worth of ETH, USDC, and BTC
Plasma Chain: lent out $90 million USDT, plus nearly $4 million in other stablecoins
This $120 million accounts for almost half of the total exposure. If xUSD goes to zero, TelosC and its investors will suffer massive losses.
If you have deposits in these markets on Euler, you may already be unable to withdraw normally. Even if Stream can eventually recover some funds, the liquidation and bad debt handling will take a long time.
- ### **Indirect Explosion: **Elixir's deUSD, $68 million
Elixir lent $68 million USDC to Stream, which accounts for 65% of the deUSD stablecoin reserves. Although Elixir claims they have "1:1 redemption rights" and are the only creditors with such rights, the Stream team previously responded that, in essence, until the lawyers determine who should get what, they cannot make payments.
This means that if you hold deUSD, two-thirds of your stablecoin's value depends on whether Stream can repay. And now, it seems that this "whether" and "when" are both unknowns.
- ### Other Some Dispersed Risk Points
On Stream, "Curators" are professional institutions or individuals responsible for managing the fund pools. They decide which collateral to accept, set risk parameters, and allocate funds.
In simple terms, they act like fund managers, using other people's money to lend for profit. Now, these "fund managers" are all trapped by Stream's collapse:
- MEV Capital - $25.42 million: An investment firm focused on MEV (Maximum Extractable Value) strategies. They have layouts across multiple chains:
For example, in the Euler market on the Sonic chain, $9.87 million in xUSD and 500 xETH were deposited; there is also an exposure of $17.6 million in xBTC on Avalanche (272 BTC borrowed).
- Varlamore - $19.17 million: They are the main liquidity provider on Silo Finance, with exposure distributed as follows:
$14.2 million USDC on Arbitrum, accounting for nearly 95% of that market;
Approximately $5 million on Avalanche and Sonic, with Varlamore managing funds from institutions and high-net-worth individuals, this incident could lead to large-scale redemptions.
- Re7 Labs - $14.26 million: Re7 Labs has set up a dedicated xUSD market on the Euler platform on the Plasma chain, with the entire $14.26 million in USDT.
Other smaller players that may be affected include:
Mithras: $2.3 million, focused on stablecoin arbitrage
Enclabs: $2.56 million, across both Sonic and Plasma chains
TiD: $380,000, although the amount is small, it may be their entire funds
Invariant Group: $72,000
These Curators are certainly not gambling with the deposited funds; they must have assessed the risks. However, when the upstream protocol Stream encounters issues, all downstream risk control measures will be very passive.
Is the bear market staging a crypto version of the subprime mortgage crisis?
If you have seen the movie "The Big Short," what is happening now may feel familiar.
In 2008, Wall Street packaged subprime loans into CDOs, then repackaged them into CDO², with rating agencies labeling them as AAA. Today, Stream has amplified user deposits threefold through circular nesting, and xUSD is accepted as "high-quality collateral" by major lending platforms. History does not repeat itself, but it certainly rhymes.
Stream previously claimed to have $160 million in deposits, but in reality, this level of deposits ultimately deployed into $520 million in assets. How did this number come about?
DefiLlama has long questioned this calculation method; circular lending nesting essentially involves double counting the same money, which is a manifestation of inflated TVL.
The contagion path of the subprime mortgage crisis was: mortgage defaults → CDO collapse → investment bank failures → global financial crisis.
This time, the path is: Balancer hacked → Stream bank run → xUSD decouples → $285 million in loans become bad debts → more protocols may collapse.
Using DeFi protocols for high-yield mining, when the market is good, people rarely ask how the money is made or where the profits come from; once a negative event occurs, the loss could be the principal.
You may never know the true risk exposure of your funds in DeFi protocols. In a DeFi world without regulation, insurance, or a lender of last resort, the safety of your funds can only be protected by yourself.
The market is not good; may you be safe.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
