Written by: Liu Jiao Lian
Introduction: A Fortunate Coincidence
On April 18, 2026, the rsETH cross-chain bridge of Kelp DAO was attacked, and assets worth approximately 292 million US dollars were stolen. The attacker deposited the stolen rsETH into Aave and borrowed ETH, triggering panic over bad debts. The ETH utilization rate on Aave instantly soared to 100%, locking the funds of countless innocent depositors.
Two months earlier, on February 5, Jiao Lian had just transferred all deposits from Aave to Spark. The motivation was simple: the yield on Spark was slightly higher than Aave's. As a result, they inadvertently avoided this crisis.
This was not foresight, nor was it judgment; it was purely luck. But this luck prompted Jiao Lian to start seriously considering a question: Could they be so lucky next time?
Leveraging this incident, Jiao Lian reflected on the pitfalls they had encountered, the lessons they had learned in the DeFi world, and their ultimate thoughts, which they wrote below.
1. April 18, 2026: How the Butterfly Flaps Its Wings
1.1 The Attack Itself
At 17:35 UTC on April 18, a wallet controlled by an attacker invoked LayerZero's EndpointV2 contract, triggering Kelp DAO's cross-chain bridge contract and releasing 116,500 rsETH to the attacker's address. At the time's market price, this was valued at approximately 292 million US dollars.
The attacker's wallet had obtained funds from a 1 ETH pool through Tornado Cash 10 hours earlier, which is a common method of obscuring funds in DeFi attacks.
Kelp DAO's reaction was not slow. 46 minutes later, its emergency pause multi-signature wallet executed pauseAll, freezing the core contract and preventing two subsequent attempts to steal approximately 100 million US dollars.
1.2 Risk Transmission to Aave
But the real storm was not in Kelp DAO, but in the more well-known lending protocol Aave.
The attacker deposited the stolen rsETH into Aave, using it as collateral to borrow ETH. This action transformed the external attack into bad debt risk within Aave.
The market quickly reacted. Whales began to withdraw ETH from Aave. According to monitoring by Lookonchain, the ETH utilization rate on Aave quickly reached 100%—meaning there was almost no ETH left in the pool for withdrawals or new loans.
Those innocent users who had never touched rsETH and had only deposited ETH also found their funds locked.
This is the cost of shared pool lending: you don’t need to directly touch the bad apples; as long as you are in the same pool, you will be affected.
1.3 The Inherent Risks of Non-Isolated Lending
Curve founder Michael Egorov tweeted after the incident: This is the inherent risk of the beloved non-isolated lending model. It offers good scalability, but carries higher risks. Risk management is key, and Aave has historically done well in this regard.
What he implied was: this model inherently has this problem; it is not a flaw unique to Aave.
Jiao Lian believes this judgment is correct. But the problem is, ordinary users find it difficult to predict when the risk will become reality.
2. The Contradiction of Moments: Hear Their Words vs Observe Their Actions
2.1 The Split Between Reassurance and Action
Aave's official statement asserted that the situation was under control, and that the security module Umbrella could serve as the first line of defense.
But the real discussion was sparked by Andre Cronje's (AC) actions.
AC stated in a tweet: Aave has 7 billion US dollars in ETH deposits, and only 100 million US dollars has been withdrawn, which has a minimal impact. Even if a bad debt occurs, Aave's security module and AAVE token are the first line of defense.
At the same time, the PUT protocol he founded withdrew all ETH from Aave. His explanation was: The primary goal of PUT is user liquidity, and the available liquidity on Aave dropped below our minimum threshold; this was just a rule trigger, not a judgment that Aave would go bankrupt.
From a rules perspective, he did nothing wrong. But from the observer's standpoint, it is difficult not to form the impression that he says one thing and does another.
2.2 History Always Rhymes
This is not the first time.
In May 2022, Luna collapsed. Do Kwon repeatedly reassured during the UST de-pegging not to panic; the algorithm would recover. Those who believed him were buried.
In November 2022, FTX collapsed. SBF stated after the run on the bank that the assets were fine and FTX was very healthy. Those who believed him were also buried.
Jiao Lian has friends who had substantial deposits in FTX. When he saw panic and reassurance occurring simultaneously, he chose to withdraw funds for safety. He said afterwards that he did not know whether FTX would collapse, but he knew that if it did, he would not be able to escape. Thus, he chose to run first.
This logic, Jiao Lian believes, is what ordinary users should remember most during a crisis: A gentleman does not stand under a precarious wall. Whether the wall will fall, you may not know. You only need to know that you don’t need to stand underneath it.
3. Jiao Lian's Two Experiences: From Being Trapped to Sheer Luck
3.1 The First Time: Compound Locked
In November 2025, Jiao Lian deposited some USDC in Compound. Jiao Lian did not touch deUSD and did not know what xUSD was.
But on November 4, the xUSD team admitted to a 93 million US dollar deficit, causing xUSD to de-peg. The deUSD behind it also followed suit. And Compound accepted deUSD as collateral. At 5 AM, Compound urgently paused withdrawals.
Jiao Lian's funds were locked.
That day, Jiao Lian wrote in an article: I could have been calm and steady, withdrawing funds a day in advance to avoid risk. Now, the sudden suspension of withdrawals left me with no chance to hurriedly escape.
Fortunately, the bad debt scale was only a few million dollars, covered by the security module, and ultimately, there was no danger.
But Jiao Lian learned a lesson: risks can transmit. You don’t need to directly touch bad apples; as long as you are in the same pool, you will be affected.
3.2 The Second Time: Aave Evacuated
On February 5, 2026, Jiao Lian transferred deposits from Aave to Spark.
The reason was simple, even a bit mundane: Aave’s yield had decreased, while Spark's was slightly higher. Jiao Lian simply moved money from a low-interest space to a higher-interest one.
This move happens on countless ordinary days. Jiao Lian did not foresee that Aave would encounter trouble two months later, did not analyze the risks of rsETH, nor had any insider information.
Yet, they inadvertently avoided the Aave crisis in April.
Jiao Lian defined this as luck. But they also wondered if there is a certain inevitability behind this chance?
3.3 Comparing the Two
The first time: passively trapped, escaped by luck. The second time: actively mobile, accidentally avoiding risks.
There is no need to pursue correctness in judgment, nor is it easy to do so. As long as one maintains liquidity freedom, they could inadvertently avoid some pitfalls.
But this is not a long-term solution. As the saying goes, those who walk by the riverbank often get their shoes wet.
4. A New Battleground: The Opacity of Spark
4.1 A Temporary Refuge
After leaving Aave, Jiao Lian placed part of the funds in Spark.
What is Spark? The Spark liquidity layer is an automated capital allocator that allocates assets like USDS, sUSDS, USDC, and others to various DeFi protocols and RWA products to optimize yield.
4.2 Asset Composition
According to Spark's official data, its liquidity layer has total assets of approximately 2.1 billion US dollars.
Jiao Lian noticed that over 90% of the assets are on-chain stablecoins that can be tracked. However, about 7% of the assets are managed by an institution called Anchorage, which are off-chain assets that ordinary users cannot penetrate.
4.3 Risk Exchange
Jiao Lian believes that moving from Aave to Spark is not a security upgrade, but a risk exchange.
In protocols like Aave/Compound, risks are relatively transparent: what the collateral is, the liquidation threshold, and the code is open-source. The sources of risk are market fluctuations or attacks.
In Spark, risks introduce new dimensions: institutional custody, RWA, and opaque strategies. You do not know exactly what Anchorage’s 150 million US dollars is doing, nor can you monitor each adjustment of the strategy in real time.
This is not to say that Spark is unsafe. Since its launch, Spark has managed over 4 billion US dollars in assets, maintaining a record of zero security incidents. What Jiao Lian wants to convey is: every protocol has risks, just differing in types. Ordinary users need to know what risks they are accepting, rather than blindly believing that a certain protocol is always safe.
5. Historical Comparison: Four Lessons
Jiao Lian has compiled DeFi crises observed and experienced over the years into a table:
From these four incidents, Jiao Lian summarizes four lessons:
First: Do not stand under a precarious wall. When abnormal signals appear, assume the wall may fall first and evacuate. If the wall does not fall, you only lose a bit of Gas fee and a few days’ interest. If it does fall, you preserve your entire principal.
Second: Do not trust reassurances; only observe actions. Any KOL or founder's reassurances must be validated by their actions. Those who shout do not bear the consequences, while those who act are responsible for themselves.
Third: Maintain liquidity freedom. Never put yourself in a position where you want to run but cannot. 100% utilization is a typical signal—when you want to run, it is already too late.
Fourth: Recognize risk exchanges. Before choosing any protocol, ask yourself: what yield is being exchanged for what new risks? On-chain transparent risks vs. off-chain institutional risks, market volatility risks vs. strategy error risks; there is no absolute safety, only different types of risks.
6. The Ultimate Answer: Exit the Game
6.1 Why Exit
Jiao Lian has realized one thing: as long as you pursue yield, you are always exposed to some risk.
In Aave, you are exposed to shared pool transmission risks. In Spark, you are exposed to institutional transparency risks. In stablecoins, you are exposed to issuer and regulatory risks. In wrapped BTC, you are exposed to custody and cross-chain bridge risks.
With each protocol change, you are merely exchanging one risk for another. It is not an upgrade; it is an exchange.
6.2 Jiao Lian's Plan
In this bear market, convert all or most of my funds in DeFi gradually into on-chain BTC.
Not wBTC, not cbBTC, not any wrapped assets. It is native BTC. Stored in a wallet under my full control.
Jiao Lian believes this is the only state of assets in the crypto world that does not require trusting any third party.
It does not rely on protocol code, does not rely on teams, does not rely on collateral, does not rely on custodians. The only dependency: the ability to secure private keys.
6.3 Costs and Responsibilities
On-chain BTC does not generate interest. This is the cost.
The risk of private key management shifts from the protocol to oneself. This is the responsibility.
The conversion process itself also carries risks and requires cautious handling.
Jiao Lian is willing to accept these costs. Because from Jiao Lian's perspective, the sense of security from not relying on anyone is worth sacrificing that few percent of so-called annualized yield.
6.4 The Final Words
We entered the crypto market initially looking for a place that does not require trusting banks. After going around, in DeFi, we trusted the code, trusted the teams, trusted the security modules, trusted the assurances of KOLs...
In the end, the real endpoint is still returning to that most elementary starting point: taking care of your own Bitcoin.
References:
[2] Lookonchain, X post on Aave ETH utilization rate reaching 100%, Apr 19, 2026.
[3] Michael Egorov, X post on non-isolated lending risks, Apr 19, 2026.
[4] Andre Cronje, X post on PUT withdrawal decision, Apr 19, 2026.
[5] Liu Jiao Lian, Butterfly Storm, November 5, 2025. [Link]
[6] Spark, Spark Liquidity Layer official data.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
