Author: Spinach
On November 4, 2025, the DeFi circle experienced a "Black Tuesday."
Stream Finance, a yield aggregation protocol that once had a TVL exceeding $200 million and claimed to be "The SuperApp DeFi Deserves," suddenly announced: a "external fund manager" caused a loss of approximately $93 million, and all deposit and withdrawal functions would be suspended immediately.
Upon the announcement, its issued stablecoin xUSD plummeted from $1 to $0.26, a 77% drop within 24 hours. More critically, xUSD was widely used as collateral in mainstream lending protocols such as Morpho, Euler, Silo, and Gearbox—one bomb detonated, causing severe turbulence in the entire DeFi lending market.
According to statistics from the DeFi research institution Yields And More (YAM), Stream-related debt exposure reached as high as $285 million:
Elixir's deUSD, which had lent $68 million USDC to Stream due to a 65% reserve, announced an immediate shutdown, with the coin price dropping from $1 to $0.015, nearly going to zero.
Compound suspended the USDC/USDS/USDT market.
Euler froze related liquidity pools.
Morpho experienced bad debts.
Within a week, the DeFi market saw a net outflow of approximately $1 billion. Some compared this to the "Terra moment of 2025," and Aave founder Stani Kulechov even warned on social media: "The next Terra Luna may be brewing."
Recently, Spinach happened to be deeply researching Curator, and due to the Stream Finance incident, Curator was also thrust into the spotlight. Therefore, I looked into the ins and outs of this matter to help everyone piece together the full picture.
Scapegoat: How did Curator get blamed?
After the incident, public opinion quickly pointed to one character: Curator.
How did this blame get passed on? Looking back at Stream's official statement on November 4, the loss was caused by an "external fund manager."
This wording easily evokes thoughts of Curator in DeFi lending protocols—those "curators" responsible for managing liquidity pools and setting risk parameters in protocols like Morpho and Euler.
The chain reaction following Stream's collapse made this narrative seem more "solid":
On November 6, Lista DAO urgently initiated a governance vote to forcibly liquidate the Vault managed by MEV Capital and Re7 Labs—borrowing rates had soared to 800%, and the borrowers showed no signs of repayment. Re7 Labs subsequently released a statement admitting that its xUSD isolated vault on Euler had an exposure of about $14.65 million.
Top Curator Vaults collectively collapsed, and an emergency vote for forced liquidation was held—could this not be a Curator issue?
Rhythm BlockBeats published a widely circulated article after the incident titled "DeFi's Potential $8 Billion Bomb, Only $100 Million Has Exploded," attributing the explosion to "external Curators using user funds for opaque off-chain trading," and characterizing it as a "systemic crisis of the Curator model."
Meanwhile, another "coincidence" made the situation even murkier—just a day before Stream's collapse (November 3), Balancer was hacked, resulting in a loss of about $128 million.
Thus, the mainstream narrative became: Curator misappropriated client funds for high-risk strategies, invested in Balancer, Balancer got hacked, the money was gone, and the Curator model is unreliable.
But there is a key question here: Was Curator really the core reason behind Stream's collapse?
It wasn't until the lawsuit documents were made public on December 8 that we could glimpse the full picture of the incident.
The Truth Emerges: Another Story Unveiled by the Lawsuit Documents
On December 8, Stream Trading Corp. (the original founding team of Stream) filed a lawsuit in the federal court in San Francisco against Caleb McMeans (online alias 0xlaw) and Ryan DeMattia.
This lawsuit document revealed a completely different story.
Project Handed Over: A "Purchase" Without Cash
According to detailed reports by DL News on the lawsuit documents:
In February 2024, Argentine crypto investor Diogenes Casares founded Stream Protocol. In April of the same year, the project completed a $1.5 million seed round financing, led by Polychain, with a valuation of $20 million.
However, after only 9 months of operation, by November 2024, the founding team decided to shut down the project due to "operational challenges."
At this time, trader Caleb McMeans appeared. He proposed to acquire Stream as a "complex yield strategy management expert."
In January 2025, both parties signed an agreement:
McMeans gained complete control of the protocol, including all on-chain transactions, off-chain business agreements, and user deposit management rights.
In exchange, he was to pay the original team a 35% fee share and promised to "fully transparently disclose the location of fund deployments."
Note: This was not a cash acquisition—McMeans did not pay money to buy the protocol but signed an agreement of "I will operate, you will charge." The original team retained the role of service provider for the smart contracts, website, and tokens.
Out-of-Control Assets: $90 Million Handed to Someone with "No Formal Relationship"
The problem arose after McMeans took over. According to the lawsuit documents, he handed over more than $90 million of the protocol's assets to someone named Ryan DeMattia for off-chain management.
Who is DeMattia? The description in the lawsuit documents is quite subtle: McMeans initially referred to him as an "employee," but later admitted that he had "no formal relationship" with DeMattia.
No formal relationship, yet entrusted this person with over $90 million of off-chain assets—absurd, right?
Even more absurd things followed.
Laptop Destroyed in a Car Accident
In September 2025, the original founding team began demanding McMeans increase transparency and wanted to know where the funds were going. McMeans's response was "continuous delays and excuses."
When the team pressed DeMattia, his response was even more remarkable—the original text of the lawsuit documents states:
"DeMattia offered a series of patently false excuses for why he could not provide any further information, even claiming at one point that his laptop had been destroyed in a car crash."
This excuse's creativity could only be rivaled by "my dog ate my homework."
The lawsuit documents continued to state that McMeans even advised the original team to "stop asking questions and just trust DeMattia."
October 10: Personal Liquidation, Misappropriation to Cover Losses
Then came October 10.
On that day, the price of ETH plummeted by 21%, setting a record for the largest single-day liquidation in crypto history, with about $20 billion in positions liquidated. The lawsuit documents describe:
"But upon information and belief, on October 10, 2025, Mr. DeMattia faced a margin call on a personal loan for which he lacked sufficient funds to cover, had his position liquidated, and then used Stream Protocol assets to which he had access to cover his loss."
In plain language: DeMattia's own leveraged position blew up, he had no money to cover it, and he casually took Stream's money to fill the hole.
On November 2, DeMattia finally "confessed." According to DL News:
"On November 2, he admitted he had lost 'nearly all' of the Stream protocol assets under his control, which were worth about $93 million at the time."
Timeline Doesn't Match: Balancer is Just a Cover-Up
Please note this date: November 2.
When was Balancer hacked? November 3.
If Stream's $93 million was lost in the Balancer hack, the loss should have occurred on November 3. But DeMattia had already admitted on November 2 that he had "lost everything"—the timeline doesn't match.
More crucial evidence: the lawsuit documents indicate that McMeans deleted "all private Discord communications with DeMattia since October 10"—exactly the day DeMattia is believed to have started misappropriating funds.
If the loss was indeed caused by the external event of Balancer being hacked, why delete the chat records starting from October 10?
The answer is clear: the Balancer hack was likely just a "convenient coincidence," used to divert attention, confuse the timeline, and provide a "force majeure" cover for internal misappropriation.
BlockEden's analysis report also corroborated this point: "No evidence of a smart contract hack or exploit has been found."
Essence: Personal Misappropriation, Makeshift Operations
So, what ultimately caused this collapse? Was it the systemic risk resulting from the failure of the Curator model, or was it the blatant makeshift behavior that allowed for personal asset misappropriation?
The answer provided by the lawsuit documents is clear: it was personal misappropriation.
DeMattia was not a professional Curator institution; he was an off-chain trader privately hired by McMeans, with "no formal relationship" to the protocol. He gained actual control over more than $90 million in assets without custodial isolation, no multi-signature protection, and no on-chain verifiability—when his personal positions collapsed, he directly took user funds to cover his own losses.
Amplifier: How xUSD's Circular Lending Expanded the Hole
This incident of personal fund misappropriation, due to the circular lending strategy of xUSD, created a $285 million pit.
If Stream were merely a simple custodial protocol, DeMattia's misappropriation of $93 million would result in a maximum loss of $93 million. However, because xUSD was designed to circulate, collateralize, and re-lend across major protocols as a "yield-enhanced stablecoin," this $93 million hole acted like a virus, infecting the entire ecosystem through DeFi's composability.
Circular lending was not the cause of the disaster, but it served as an amplifier of the disaster's scale.
Yearn developer Schlag had warned before the collapse: "With the same $1.9 million USDC, they minted about $14.5 million xUSD"—a 7.6 times leverage of funds. When the underlying assets encountered issues, this leverage ratio turned into an accelerator of destruction.
When the underlying asset (the $93 million held by Stream) disappeared, the entire circular lending structure collapsed instantly, and the debt exposure ballooned from $93 million to $285 million.
Conclusion: Review, Reflection, and Future
Let’s outline the complete chain of this collapse:
Starting Point: The Stream Finance project team "sold" the protocol to trader McMeans, who handed over $93 million of user assets to DeMattia for off-chain management, despite having "no formal relationship."
Trigger: On October 10, ETH plummeted, DeMattia's personal positions were liquidated, and he directly misappropriated Stream funds to cover his losses.
Amplifier: The xUSD circular lending structure magnified the $93 million hole into a $285 million debt exposure, infecting the entire DeFi lending market.
Cover-Up: On November 3, Balancer was hacked for $128 million, providing a perfect excuse to divert attention—despite DeMattia having already admitted to losing everything on November 2.
Scapegoat: Public opinion pointed fingers at the Curator model, overlooking the real issue of personal misappropriation.
What is the essence of this collapse?
It is not the failure of the Curator model.
In protocols like Morpho and Euler, Curator permissions have clear boundaries—they can set risk parameters, adjust collateral ratios, and decide which assets to accept, but they cannot directly transfer user funds. The assets deposited in the Vault are locked in smart contracts, and Curators have no authority to withdraw them.
The Curators who were thrust into the spotlight had issues of "negligence": accepting problematic assets like xUSD as collateral without conducting thorough due diligence.
It is not the original sin of circular lending strategies.
Recursive lending itself is merely a tool to amplify returns and risks. When used well, it is efficient capital operation; when misused, it is suicidal leverage. Stream's circular lending amplified the scale of the disaster, but it was not the cause of the disaster.
The real problem is: one person can control tens of millions of dollars in user assets without any constraints.
No custodial isolation
No multi-signature protection
No on-chain verifiable flow of funds
No compliance audits
Not even a formal employment contract
This is the most primitive betrayal of trust—handing money to one person, only for that person to take the money away.
This is also the current state of the DeFi industry: makeshift operations run rampant, with a lack of regulation. A DeFi protocol can be "transferred" at will, user funds can be misappropriated at will, and there are no real institutional constraints in the entire process.
However, crises often present opportunities.
The collapse of Stream is forcing the industry towards maturity. As regulatory frameworks and legislation continue to improve and take effect, more transparent, compliant, and professional protocols and service providers will represent the true opportunities for the future of this industry.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
