Until last Friday, April 17, lending stablecoins into Aave, widely considered the gold standard of DeFi, paid 2.32% APY. The Federal Reserve’s overnight rate was 3.64%. Taken at face value, the market was pricing an unregulated, open-source smart contract as a lower credit risk than the United States Treasury.
In 48 hours, that ended. The market did in real time what no regulator, auditor, or commentator had managed to do: it repriced DeFi credit risk.
The mispricing
Rank the dollar-credit options by yield before last weekend, and the hierarchy made no sense. Treasury overnight: 3.64%. Ledn’s investment-grade Bitcoin-backed ABS senior tranche, priced in February at BBB-: 6.84%. Strategy’s STRC perpetual preferred: 11.50%. U.S. credit cards: 21% against a 4% default rate. And Aave, sitting well below it all: 2.32%.
Something had to give. Luca Prosperi argued earlier this year that DeFi stablecoin rates should carry a 250–400 basis-point premium over the risk-free rate, implying 6.15–7.76%. The Bank of Canada’s April 2nd report took the opposite view, citing Aave’s 0.00% non-performing loan rate as proof that DeFi’s architecture delivers defaultless lending through strict collateral requirements and price-based enforcement.So what does this all mean? Either DeFi had solved credit risk, or the market had stopped pricing it.
Only one side could be right. Last weekend, we found out which.
The 1/1 problem
On April 18th, an attacker exploited Kelp DAO’s LayerZero-powered cross-chain bridge to mint roughly 116,500 unbacked rsETH tokens — about 18% of the circulating supply, worth around $292 million. The synthetic tokens were moved into Aave as collateral. The attacker borrowed an estimated $190–230 million of real assets against collateral that, when it mattered, didn’t exist. Aave’s incident report acknowledged the protocol functioned as designed; the shortfall is structural, not technical. Kelp and LayerZero have since publicly blamed one another for the 1/1 validator configuration that made the exploit trivial.
The contagion was instant. DeFi protocols are interoperable by design, and “looping” — borrowing on one platform and redepositing the proceeds as collateral on another — means a hit to Aave is a hit to everything built on top of Aave. Roughly 20% of Aave’s historical borrow volume has come from recursive leverage. Within 48 hours, $6–10 billion in net outflows left Aave. Utilization on WETH, USDT, and USDC pools hit 100%. Depositors couldn’t withdraw. Borrowers couldn’t source stablecoin liquidity. Stranded users borrowed another $300 million against their own locked stablecoin deposits at 75% LTV, often at a loss, just to access cash.
Rates responded accordingly. Aave stablecoin deposit APYs went from 3–6% pre-exploit to 13.4% within two days. Morpho’s USDC vault, which powers Coinbase’s consumer loan product, jumped from 4.4% APR on April 18th to 10.81% the next day as the liquidity scramble rippled outward. Total DeFi TVL across the top 20 chains fell by more than $13 billion.
No bankruptcy, no court, no recourse
Here is the part that won’t make headlines, and that allocators need to understand.
There is no bankruptcy law inside a DeFi protocol. If you withdraw first, you keep everything. If you are among the last, you don’t — and you may absorb a disproportionate share of the losses. Regulated lenders have a legal duty to halt operations the moment they realize they cannot cover liabilities, and bankruptcy courts can claw back from parties who benefited unfairly. The Celsius, BlockFi and FTX wind-downs were grueling, but creditors recovered assets, and the people responsible faced a judge.
In DeFi, there is no process. There is no court. There is no recovery. There is no one to hold accountable.
That has direct consequences for risk sizing. If you can estimate the total loss but cannot predict how it will be distributed, you cannot estimate your own exposure. It may be zero. It may be everything. It depends on how fast you moved, and on how fast the people next to you moved.
What happens next
DeFi is not going away. The architecture has real utility, and permissionless markets have always existed — across every asset class and in every era. But they have never been risk-free, and they have always carried a premium over their regulated equivalents. The 48 hours following the April 17 incident reminded the market that the same rule applies onchain.
Institutional allocators sizing DeFi exposure for the coming year should take the signal seriously. The 2.32% Aave APR before last weekend did not reflect the underlying risk, and the market has now adjusted. Where DeFi rates settle from here is for the market to decide. But the mispricing is over. Last weekend proved it.