Author: Curi, Deep Tide TechFlow

Decentralized finance has a core tenet: users' money is safeguarded by code, and in the event of an issue, there is no need to find anyone to cover it.

Now, the largest lending protocol in DeFi, AAVE, is organizing the entire industry to raise funds to cover the losses.

In the early hours of April 23, Aave founder Stani Kulechov posted on X, stating that he would contribute 5000 ETH to a fund called "DeFi United," worth approximately 11.5 million dollars at the time.

This money is used to fill the gap.

Six days ago, a hacker exploited vulnerabilities in the KelpDAO cross-chain bridge to create a batch of fake tokens unsupported by any collateral, which were inserted into Aave as collateral, allowing them to borrow nearly 200 million dollars in real ETH. Aave is the largest lending protocol in DeFi, managing over 30 billion dollars of user assets. Once the news broke, whales and institutional users were the first to flee, and in just six days, Aave's total deposits evaporated by nearly 15 billion dollars, draining the core liquidity pool.

(Recommended reading: “After the KelpDAO Hack, AAVE's Situation is Worse Than You Think”)

Those deposit users who haven't run away now can't even withdraw their own money. According to CoinDesk reports, the utilization rate of the USDT and USDC liquidity pools once approached 100%.

Stani's wording in that tweet is worth savoring; he stated that Aave is his "lifelong career." When a founder openly uses this term, it often indicates that the situation has become serious enough to warrant a statement.

Thus, this DeFi United is an industry rescue mechanism led by Aave's founder. As of today, publicly committed contributors include Ethereum staking protocol Lido, re-staking protocol EtherFi, the Golem Foundation, and Bybit’s Mantle.

However, upon closer inspection, it’s evident that the rescue efforts of these five entities have not yet been fully realized.

What can be confirmed is Stani's personal 5000 ETH and the Golem Foundation's 1000 ETH. Lido's proposal for 2500 stETH and EtherFi's proposal for 5000 ETH are still in their respective DAO voting processes. Mantle’s proposed 30,000 ETH is labeled as a loan, which is also still in the planning phase in the governance forum.

Moreover, Lido's proposal includes a prerequisite: funds will only be allocated after a complete restoration plan has been assembled. This means that if the total amount is not reached, they may not contribute.

How substantial was the hole left by KelpDAO?

The hacker borrowed approximately 99,600 ETH in total, with the Arbitrum security committee freezing 30,700 ETH of it, leaving a remaining gap of about 68,900 ETH, equivalent to about 160 million dollars.

The total potential support from all parties adds up to about 43,500 ETH, still leaving a shortfall of 25,000 ETH, which has no one to claim it.

DeFi version of the “Troubled Asset Relief Program”

In September 2008, two weeks after the collapse of Lehman Brothers, the U.S. Treasury launched something called TARP, short for “Troubled Asset Relief Program.” In simple terms, Wall Street caused a mess, and the government organized a bunch of financial institutions to pool money into a fund to shoulder the bad debts and avoid a systemic explosion.

What DeFi United is doing is structurally almost identical to TARP.

If Aave’s bad debts are not covered, the consequences will not only affect Aave. The rsETH token is used as collateral by many DeFi protocols, and according to Aave's incident report, Aave itself holds about 83% of the circulating supply of rsETH.

If the anchoring of these assets cannot be restored, the bad debts will spread through all protocols that accept rsETH like an infectious disease. According to Lido's proposal description, users of just the EarnETH treasury might face forced liquidation losses of up to 9000 ETH.

This is why competitors also come to contribute. Lido and EtherFi are not allies of Aave; they also operate lending or staking businesses. But once rsETH becomes completely unpegged, their users and liquidity pools will suffer as well. Saving Aave is essentially saving themselves.

The logic of the financial crisis is likely similar. Goldman Sachs didn't agree to contribute to TARP because it cared for Merrill Lynch; it did so because if Merrill Lynch collapsed, Goldman Sachs wouldn't survive either. The contagious nature of the financial system dictates that when an institution is “too big to fail” faces problems, everyone must pitch in.

However, we all understand the key difference.

TARP had the U.S. Treasury and the Federal Reserve backing it. The Treasury has the power to compel financial institutions to participate, and the Fed can inject liquidity infinitely.

This time, there is no institution behind DeFi United with the authority to compel anyone to contribute funds. Lido's 2500 stETH must wait for DAO votes, EtherFi’s 5000 ETH must wait for DAO votes, and Mantle’s 30,000 ETH must wait for governance discussions.

Thus, the current situation for DeFi or AAVE is that it needs a “rescue plan,” but its rescue plan is essentially a crowdfunding effort. Whether DeFi United can succeed depends on the community votes of each participating party, who must determine whether it is worth spending their own treasury funds to fill someone else's gaps.

This may be the first time the crypto industry has reached this crossroads.

In the past, when DeFi protocols had problems, either the founding team covered the losses themselves, or users walked away suffering losses. There has never been a time when competitors sat down to jointly contribute funds to save a common systemic risk.

Am I paying the bill again?

Whether DeFi United can ultimately gather the 68,900 ETH remains unknown today. But one thing is certain: regardless of the outcome, those who will pay for this hole have already been identified.

According to the incident report on Aave's governance forum, if the shortfall cannot be completely filled, the bad debt will be distributed among Aave's deposit users. Specifically, those who deposited WETH into Aave to earn interest may find their accounts reduced.

It is estimated in the report that the scale of the bad debt depends on how the losses from rsETH are distributed, with a minimum of about 123 million dollars and a maximum of up to 230 million dollars.

What did these users do? They deposited some ETH and earned a few percentage points annually. They may not have known that KelpDAO would run into problems, nor did they know that there was a cross-chain bridge using a message verification mechanism called LayerZero, which had security configuration issues.

But their money was used as a counterparty for the ETH borrowed by the hacker.

If all proposals are passed and funds are secured, deposit users might walk away unscathed. If the total cannot be assembled, these users' deposits will be reduced, with the extent depending on how large the shortfall is.

And they have no voting rights in this matter. The deposit users who truly bear the consequences have no voting buttons to press in this process.

According to CoinDesk, Circle’s chief economist Gordon Liao has proposed an emergency plan on the Aave governance forum, suggesting raising the lending rate cap from 10% to 50% to attract new capital to alleviate liquidity exhaustion...

In other words, Aave's strategy now is to use more expensive funds to fill deeper holes.

After the 2008 financial crisis, the world spent a lot of time establishing various deposit insurance systems, stress tests, and systemic risk regulatory frameworks, with the core goal being one:
to ensure ordinary depositors no longer pay for the risky behavior of financial institutions.

DeFi has taken nearly 10 years to build a system that bypasses these institutions. But the pitfalls that the banking industry has faced for hundreds of years will not simply disappear because you have changed the code. Bank runs, bad debt contagion, and innocent savers being forced to pay the bill have not diminished at all.

As of the time of writing, the available liquidity in Aave's USDC pool is less than 3 million dollars. If you now want to withdraw your stored stablecoins from the largest lending protocol in DeFi, it is still highly likely that you cannot do so.

Whether DeFi or CeFi, I hope this time it’s not ordinary people who pay the bill.