Author: Cooper Duschang

Translated by: Deep Tide TechFlow

Deep Tide Insights: Someone withdraws $190 million in liquidity from Aave's USDC pool every night, only to return it half an hour later—this operation causes all borrowers to pay an additional $6 million in interest each year. Deep Tide tracks on-chain fund flows and finds that this is likely a forced process for a certain fund to prove to investors daily, "I indeed hold this money." The transparency of DeFi exposes the hidden taxes that traditional financial compliance processes impose on on-chain users.

Key Findings

Since May, the utilization rate of Aave's USDC pool surges every midnight UTC. The reason is that someone withdraws $190 million USDC around 11:30, only to deposit it back within an hour. This affects the interest rates for all lenders and borrowers in the pool.

By tracking the flow of funds from this wallet, we find that the most plausible explanation for this behavior is that a certain institution needs to withdraw funds from the DeFi pool daily to take a snapshot proving ownership of the assets, and then deposit it back.

This "withdrawal-deposit" time window has become increasingly tight since July, all concentrated around midnight UTC. Compared to cases where liquidity is not withdrawn, this operation causes all USDC borrowers to pay an additional $6 million each year.

How does Aave's utilization rate mechanism work?

Aave's dual interest rate model incentivizes lending and borrowing based on target utilization. When utilization is below target, interest rates rise slowly; when it exceeds the target, interest rates spike. The utilization rate formula is (total borrowings / total deposits). For example, the more assets are borrowed, the closer the utilization rate gets to 100%.

Image: Aave dual interest rate model—interest rates spike sharply once utilization exceeds the target (such as 92%). Source: Coin Metrics / Talos

The target utilization rate for the USDC market on Aave's Ethereum main instance is 92%. Once the target is exceeded, the interest rate curve becomes steep—from 92% to 100% utilization, the borrowing interest rate skyrockets from 4% to 14%. This suppresses borrowing demand or encourages more people to deposit USDC to meet the demand.

The utilization rate of Aave's USDC market typically fluctuates around 90%. However, since May, minute-level data has shown recurring spikes in utilization.

Image: Minute-level data for Aave USDC market utilization, showing regular midnight spikes since May. Source: Coin Metrics / Talos

Why do these spikes occur?

Excluding governance adjustments or oracle manipulation, there are only two variables affecting utilization: USDC deposit volume and borrowing volume.

Aside from a brief drop in borrowings, total borrowings have averaged $1.89 billion since June 27. If borrowings do not continuously spike—which would push up utilization—that means USDC deposit volumes are plummeting.

Between 11:30 UTC and 00:30 UTC at the latest, over $150 million USDC deposits are withdrawn and deposited back. Available liquidity plummets from about $210 million to a low of only $33,000.

Image: Over $150 million USDC withdrawn and deposited back between 11:30-00:30 UTC, with available liquidity plummeting from about $210 million to a low of $33,000. Source: Coin Metrics / Talos

Who is creating these spikes?

The pseudonymity of Ethereum allows us to publicly track addresses and transactions, but does not expose users or their intentions. We found the address transferring $190 million every night: 0x56957E411Ea83a0B4A0689C1fB0D1e5eA0d20149.

Image: The flow of funds for the involved address 0x5695…0149, withdrawing liquidity from Aave and returning it after snapshots. Source: Coin Metrics / Talos

This account received funds on December 5, 2025. By checking balance changes and fund flows, we traced this target address performing similar operations in Aave's PYUSD pool in December and January. The target address receives USDC, deposits it in the Aave pool, withdraws around 11:30 UTC, sends it to 0x31173Ed183e5a9450C3671018ec4d770c8A8bF18 a few minutes later. The USDC is then returned shortly after 00:00 UTC and deposited back into the Aave pool.

This "coordinating wallet" 31173e…bf18 collects payments from the target address and another address earning yields by holding sUSDS through USDC deposits. The combined funds are sent every night to a third higher wallet 0xf1edbf98dda764ec51de3776371f0f7d6f6156a8.

This is likely a process wherein an investor is required to prove their holdings daily by removing liquidity from the DeFi pool to take snapshots.

From June to July, the average timing window for withdrawals and deposits has tightened. The withdrawal time moved from 23:20 to 23:34, and the deposit time shortened from 00:34 to 00:09. In June, the average gap between withdrawals and deposits was 259 blocks; in July, it shortened to 177 blocks.

Image: The tightening of withdrawal and deposit time windows from June to July, with the gap shrinking from an average of 259 blocks to 177 blocks. Source: Coin Metrics / Talos

What is the impact on borrowers?

The surging utilization due to liquidity withdrawals benefits depositors but is detrimental to borrowers. When utilization spikes, floating borrowing rates also soar, leading to higher temporary repayment amounts calculated per block.

The earnings or interest on Aave are paid out in a streaming manner per block. With Ethereum's average block time of 12 seconds, approximately 5 blocks are generated per minute. We broke down the annualized floating borrowing rate to simulate how a $1 million borrowing position would be affected by changes in borrowing rates each minute.

Image: How the borrowing rate changes for a $1 million position when liquidity is withdrawn, averaging an additional $9 paid per night over 18 days. Source: Coin Metrics / Talos

Over 18 days, when liquidity was withdrawn, borrowers with a $1 million position paid an average of $9 more each day compared to simulated situations where liquidity was not temporarily altered. This results in an approximate annual loss of $3,280. For total borrowings of $1.89 billion in the USDC pool, this means all borrowers pay an additional $17,000 each night, totaling $6 million per year. Borrowers are paying more due to activities unrelated to their loans.

Why does this matter?

We believe these consistent surges in utilization are best explained by a certain fund's need to prove its holdings. Establishing regulations and improving workflows around DeFi investments can help mitigate these negative impacts on lending pools. The transparency of blockchain aids in tracking the flow of funds within blockchain protocols without needing to send them to a designated address to prove their existence and control by the approving party.

Today, lenders and borrowers must not only monitor the health of their positions but also the positions within the entire pool. Tracking funds and deciphering their intentions can help assess new risks and predict changes in liquidity and interest rates.