State of DeFi Lending on Ethereum
Capital didn’t leave DeFi lending after April’s bridge exploit. It only changed venue.
Joel Obafemi15 min read·Just now--
April 2026 was the month a single configuration error in a cross-chain bridge produced the largest within-sector capital migration on record across DeFi lending on Ethereum.
The exploit itself was infrastructural. A 1-of-1 decentralized verifier on the LayerZero V2 bridge between Unichain and Ethereum was compromised, releasing 116,500 unbacked rsETH from Kelp’s Ethereum-side adapter.
The attacker supplied 89,567 of those rsETH as collateral on Aave V3 across Ethereum Core and Arbitrum and borrowed approximately $191 million in WETH against the stolen collateral before Aave’s Protocol Guardian froze the asset 90 minutes after detection.
Over the following 96 hours, the downstream consequences propagated through the lending market in a sequence that reshaped where capital sits across Ethereum’s four major lending protocols.
USDC supply APY on Aave V3 spiked above 12% as users sought alternate paths to close existing WETH positions. Cross-protocol rate dispersion hit 833 basis points on USDC and 946 basis points on USDT, more than three times their twelve-month averages.
Approximately $14.57 billion in net deposits left Aave V3 over the month, the largest single-month outflow on record. Spark gained $1.97 billion, the only protocol with positive flows. Roughly $1 billion of WSTETH migrated from Aave V3 to Spark in 30 days.
This issue walks through what happened, why it happened that way, and what it means for the four protocols going into May. Coverage spans Aave V3, SparkLend, Morpho, and Fluid on Ethereum mainnet. The data covers the calendar month, ending at the April 30 close.
The Real Yield Spread Closed for the Wrong Reason
The Real Yield Spread, the gap between the blended stablecoin lending APY across the four protocols and the 4-week US Treasury bill rate, closed 100 basis points between March 31 and April 30.
It moved from -127 basis points (1.27 percentage points below T-bills) at the March close to -26 basis points at the April close, the closest reading to T-bill parity since the inversion began in late 2025.
Stablecoin lending APY rose 97 basis points, from 2.37% at the March close to 3.34% at the April close. The 4-week T-bill drifted 4 basis points lower, from 3.64% to 3.60%.
The recovery is mechanical rather than structural. The gap closed because on-chain rates moved up, not because off-chain rates moved down. And on-chain rates moved up because the system deleveraged.
$13.18 billion in net deposits exited the four protocols in a single month, with available liquidity (the unborrowed deposits providing lending capacity) contracting 25.5%.
With idle capital leaving the system faster than borrow demand, utilization edged higher and supply rates followed. This is the textbook market-clearing response to a supply shock.
The recovery does not yet meaningfully change the regime. The spread remains inverted at -26 basis points. Stablecoin lenders continue to earn less on Ethereum than they would on Treasury bills with similar duration, before accounting for any smart contract risk premium.
The market is recovering toward parity rather than past it. For a depositor weighing the trade between an on-chain stablecoin position and a money market fund parked in T-bills, the on-chain option remains the inferior risk-adjusted choice on the headline yield.
What keeps capital on-chain in the meantime is friction, use-case lock-in, and token incentives that supplement the headline rate. None of these are durable yield arguments.
The signature observation for April is that the gap between DeFi lending and TradFi closed because DeFi got more attractive, not because TradFi got less so. That distinction matters for how to interpret what happens next.
If the spread continues closing through May without further deleveraging, the system is rebalancing organically. If the spread reopens as capital normalizes back into the system, then April was just a short squeeze rather than a regime change.
The 96-Hour Cascade
April 18, 17:35 UTC. An attacker exploited the LayerZero V2 bridge configuration on Kelp’s Unichain-to-Ethereum rsETH route. The attack vector was a structural one.
The route was set up as a 1-of-1 DVN path, meaning a single decentralized verifier could attest to inbound packets without further checks. A forged inbound packet was verified by that single attestation, with no corresponding source-side burn on Unichain.
The result was that 116,500 rsETH was released from the Ethereum-side adapter to the attacker, breaking the bridge’s lock-and-mint invariant. The Ethereum adapter balance dropped from 116,723 rsETH (one block before the exploit) to 223 rsETH immediately after.
Within minutes, the attacker fanned the 116,500 rsETH across seven branch addresses. Some addresses supplied rsETH as collateral on Aave V3 on Ethereum. Some bridged to Arbitrum and opened Aave positions on that chain.
Across Aave V3, 89,567 of the stolen rsETH (roughly $221 million at prevailing prices) were deposited as collateral, and the attacker borrowed approximately 82,650 WETH (about $191 million) and 821 wstETH (about $2.3 million) against it.
The seven addresses settled at health factors between 1.01 and 1.03, a deliberate setup that minimized buffer above the liquidation threshold while remaining solvent.
Aave’s risk framework activated within 90 minutes of detection. At approximately 19:00 UTC on April 18, the Protocol Guardian froze rsETH and wrsETH reserves across all 11 of Aave V3’s deployments, setting LTV to zero.
This blocked new supply and borrowing while allowing existing positions to be repaid or liquidated. The attacker’s collateral was now stuck on the protocol, frozen at the time of the exploit and incapable of further borrowing.
Over the following 36 hours, the Risk Steward made coordinated adjustments to the WETH interest rate model across non-Core deployments (Arbitrum, Base, Mantle, Linea), reducing the Slope 2 parameter to 1.50% and bringing the borrow rate at 100% utilization down to a sustainable 3.0% APR.
At 02:00 UTC on April 20, the Protocol Guardian froze WETH itself across Core, Prime, Arbitrum, Base, Mantle, and Linea, preventing new borrows against WETH collateral and containing risk from spreading to stablecoin reserves. A final WETH IRM adjustment on Core followed at 05:00 UTC.
Aave’s smart contracts were not compromised at any point during the event. All protocol logic, including supply, repayment, and liquidation mechanisms, continued to function as designed throughout. The exploit was external, originating from the Kelp bridge configuration, and was contained without any breach of Aave’s own contract surface.
The freezes had a second-order effect. Users with leveraged WETH positions on Aave V3 (positions unrelated to the attacker) could no longer borrow WETH on the protocol to manage existing exposures.
With WETH frozen, those users had two options: repay their WETH debt from external sources, or borrow stablecoins on Aave, swap them for WETH on the open market, and use the proceeds to repay.
The latter path drove USDC and USDT borrow demand on Aave V3 sharply higher in the days surrounding April 17 to 21. Stablecoin utilization rose, and as it crossed each protocol’s interest rate model kink, the supply APY on USDC briefly spiked above 12%.
Cross-protocol rate dispersion peaked in the same window. USDC supply APY across the four protocols hit 833 basis points of dispersion (the gap between the highest and lowest rate among the four).
The 12-month average had been 232 basis points. USDT dispersion hit 946 basis points against a 161 basis point average. WETH dispersion reached 202 basis points against a 47 basis point average.
The dispersion was Aave-specific. The other three protocols had no rsETH exploit exposure, no WETH freezes, and no rate-kink stress. Their rates stayed within normal range while Aave’s spiked.
The Migration Trade
Once the immediate stress subsided, the broader depositor base reacted to what had just played out. Capital began rotating away from Aave V3, primarily toward Spark. The trade had two distinct legs.
The first was an exit from restaked-ETH exposure: Aave V3’s weETH supply fell $870 million, rsETH stayed elevated by the attacker’s frozen collateral, and depositors using restaked LRTs as collateral either closed out or rotated.
The second was a flight to plain liquid-staked ETH on a venue without LRT exposure: Spark’s wstETH grew $980 million in April, almost exactly matching the $1.39 billion wstETH outflow from Aave V3. Morpho captured a smaller share, $349 million of wstETH inflows. Fluid captured none.
The migration is consistent with a re-pricing of the staking-stack risk premium. Plain liquid staking via Lido carries one layer of validator risk: Ethereum’s own slashing conditions. Restaking adds an additional layer, with operators acting on multiple AVSs (actively validated services), each with its own slashing surface.
The April event raised the implicit cost of that additional layer, even though the actual exploit was on the bridge rather than on the underlying restaking infrastructure. Capital responded by un-stacking, moving back to plain liquid staking on a venue without LRT exposure.
Spark captured roughly 70% of the migrated wstETH, Morpho about 25%, and Fluid none. Three explanations are consistent with the data. First, Spark’s wstETH market was the deepest pool that had no restaking-LRT contamination.
Second, Spark’s brand association with Sky and its USDS yield mechanics made it the natural safe-haven destination for capital with a trustworthy-stablecoin-economics preference.
Third, the SPK farming pool incentives, while small in absolute terms, provided a yield justification for arrivals that needed one. None of these can be cleanly weighted independently from the others, but the venue selectivity itself is unambiguous.
Spark also gained on the borrow side. USDT borrow demand on the protocol grew 216% over the month, from $177 million to $559 million. The new arrivals did not all sit on idle wstETH. Many of them immediately leveraged.
The same trade that was unwound on Aave V3 (LST collateral plus stablecoin debt) was being reopened on Spark, with wstETH as the collateral instead of weETH or rsETH. The leverage did not leave the system. It changed venue and changed the LST under it.
Four Protocols, Four Identities
Each of the four protocols ended April with a distinct identity shaped by the rsETH event. Read together, they describe how a single external shock differentiates by underlying architecture.
Aave V3 was the stress center. Total supply contracted from $31.87 billion to $20.46 billion over the month, a 36% decline that dwarfs the sector aggregate. USDT supply fell 61%, USDC supply fell 41%, and WSTETH supply fell 39%.
On the borrow side, USDT debt collapsed 49% and USDC debt 32%, an empirical signature of borrowers closing leveraged positions through whatever paths remained available after the WETH freeze.
Despite the supply collapse, Aave still earns 77% of all Ethereum-only sector fees ($50.35 million of the sector’s $65.31 million in April), a moat that survived the month intact. The supply moat shrunk in April. The fee moat did not.
One asset on Aave V3 grew during April, in apparent contradiction to the broader pattern. RSETH supply rose from $932 million to $1.19 billion. The increase is not organic. It is the attacker’s frozen collateral, stuck on the protocol with LTV at zero, awaiting Kelp’s allocation decision and the resulting oracle adjustment.
Net of the exploit-related deposit, organic RSETH supply on Aave V3 declined modestly, consistent with the broader retreat from restaked-ETH exposure visible across all four protocols.
Spark was the migration beneficiary. The protocol grew from $2.89 billion in supply at the end of March to $5.00 billion at the end of April, a 73% increase in a single month.
That is the largest single-month gain recorded across any of the four protocols in the dataset. Borrows grew alongside, from $928 million to $1.62 billion, a 75% increase. Both sides of the book expanded, which is unusual during a sector deleveraging.
The economics are thinner than they look. Spark’s take rate fell from approximately 1.2% in March to approximately 0.9% in April. Spark is the only protocol where take rate declined in April. The reason is mechanical.
Spark’s supply grew faster than its fees did. April fees of $3.74 million represented a 30.5% gain that lagged the sector’s 37.1% growth and lagged Spark’s own 73% supply growth by a wide margin. The marginal capital arrived for safety, not yield, and the pricing reflects that.
Morpho held aggregate share but consolidated underneath. The protocol’s vault economy moved from $6.01 billion to $5.71 billion in supply, a 5% contraction that is by far the smallest of the four protocols.
The vault-curator architecture absorbed the stress where pooled liquidity could not. The numbers are unremarkable on their face, which is itself the finding. A market-wide deleveraging that contracted Aave 36% touched Morpho only 5%.
Fluid was the protocol April mostly skipped. Total supply moved from $1.15 billion to $1.08 billion, a 6% decline. Borrows fell from $642 million to $575 million. None of the structural metrics moved meaningfully. The protocol that pitches itself on capital efficiency was, this month, capital-quiet.
The reason is straightforward. Fluid did not have meaningful rsETH or WEETH exposure to be stressed by, and its WSTETH market was small enough that it could not absorb the migration that flowed to Spark and Morpho.
Fluid’s identity remains its liquidation engine. The protocol liquidated 10.0% of its TVL over the trailing 90 days. Aave V3 by comparison liquidated 2.2%, Morpho 0.4%, and Spark 0.04%.
The headline penalty paid by liquidated borrowers on Fluid was 1.92% in April, against a sector mean of 9.54% across the other three protocols. Fluid is the only major protocol where being liquidated is a roughly cost-neutral outcome for the borrower.
The Curator Concentration Peak
The story underneath Morpho’s relatively flat April aggregate is one of intensified concentration. The top three curators, Steakhouse Financial, Sentora, and Gauntlet, controlled 88.6% of Morpho’s curated TVL at the end of March.
By the end of April they controlled 94.4%. The Herfindahl-Hirschman Index of curator share rose from 2,700 to 3,026 over the month. The HHI is a standard measure of market concentration: it sums the squares of the market shares of all participants, with values above 2,500 conventionally treated as a highly concentrated market.
By that definition, the Morpho vault economy is now structurally concentrated to a degree that approaches the public banking system in major economies.
Three observations follow. First, concentration intensified during a stress event, not in calm conditions. The natural assumption would be that depositors under uncertainty diversify across managers.
In practice, the opposite occurred. Confidence consolidated around the most-established curators when the rsETH event made vault-allocation decisions feel meaningful rather than routine. Capital flowed to Steakhouse, Sentora, and Gauntlet faster than it left the long tail.
Second, the three curators are not identical. Steakhouse Financial runs 18 vaults across 10 assets with a weighted net APY of 3.06% and a top vault (steakUSDT) that is the largest single vault in the Morpho ecosystem.
Sentora runs 3 vaults across 2 assets, a more concentrated approach centered on PYUSD. Gauntlet runs 20 vaults across 10 assets with a weighted net APY of 2.86%, the highest vault count in the leaderboard. The three approaches differ in breadth, asset specialization, and yield posture. They share scale.
Third, the concentration creates concrete systemic risk questions that did not exist eighteen months ago when Morpho Blue was still in its early curator-bootstrap phase.
A bad-debt event in any of the major Steakhouse, Sentora, or Gauntlet vaults could destabilize a non-trivial share of Morpho’s TVL in a single block. The curators are not the same entity, but their portfolios overlap meaningfully on collateral and oracle dependencies.
A single oracle issue affecting a commonly-used market in Steakhouse and Gauntlet vaults simultaneously could produce correlated drawdowns in roughly two-thirds of curated TVL.
The counter-argument deserves fair treatment. The concentration is not necessarily a market failure. Curator economics have positive scale effects. Larger AUM allows the curator to spread fixed costs across more capital, justifying lower fees and producing better risk-adjusted outcomes for depositors.
Capital concentrating around the curators with the most resources, the longest track records, and the most aggressive monitoring is a sensible market response, not an irrational one.
Morpho’s design pushes risk-curation responsibility from the protocol to the curator. Depositors selecting the most-resourced curators are selecting the curators best-positioned to manage that responsibility well.
The concentration is also not stable. The 5.8 percentage point increase in top-3 share over a single month suggests the concentration is dynamic, not a structural ceiling. Whether the trend reverts, plateaus, or continues remains an open question.
The Bad Debt That Has Not Been Allocated
The exploit drained Kelp’s bridge adapter from approximately 116,723 rsETH to 223 rsETH. Kelp subsequently recovered 40,373 rsETH through a FrozenFundsRecover mechanism, leaving the adapter holding 40,373 rsETH against total remote-chain rsETH claims of 152,577.
This means the adapter currently backs approximately 26.46% of outstanding remote-chain tokens. How that gap gets allocated, and whether the haircut applies uniformly across all rsETH or is concentrated on the affected bridge paths, remains undecided as of this writing.
Aave’s incident report published two scenarios bracketing the range. Under uniform socialization, every rsETH holder absorbs an equal share of the unbacked supply, implying a haircut of approximately 15.12% per token.
The implied bad debt across the seven affected Aave V3 markets totals approximately $123.7 million, concentrated on Ethereum Core in absolute terms ($91.8 million) but most acute on Mantle in proportional terms (a 9.54% WETH reserve shortfall).
Under L2-isolated socialization, Ethereum mainnet rsETH retains full backing through Kelp’s underlying ETH staking deposits, while L2 rsETH holders absorb the entire shortfall, implying a haircut of approximately 73.54% on L2 rsETH.
The implied bad debt across L2 deployments totals approximately $230.1 million, with Mantle facing a 71.45% WETH shortfall, Arbitrum 26.67%, and Base 23.28%. Kelp’s allocation decision, and the resulting oracle adjustment, are the central open question for May.
The May Test
The structural test of all of this is whether the migrated capital sticks. If Spark net deposits remain positive in May and the WSTETH inflows continue, the rotation from Aave was structural rather than panic-driven.
If Spark sees net withdrawals as SPK incentive-yield depositors rotate again, April’s flow was opportunistic and the system’s center of gravity has not actually moved. The same question applies to Aave V3 in reverse.
A stabilization in net deposits would suggest the depositor base has finished the unwind. A second consecutive month of $5 billion-plus net withdrawals would suggest the migration trade has further to run, possibly accelerated by whatever decision Kelp reaches on the rsETH allocation.
Five things to track between now and the May issue:
- The Real Yield Spread direction: The metric to watch is whether it continues closing, plateaus near parity, or reopens. A sustained reading at or above zero would mark the first month in which DeFi stablecoin lending earned more than the 4-week T-bill since the inversion began.
- Aave V3’s stablecoin utilization: Stablecoin utilization on Aave V3 is the structural metric most likely to produce a near-term rate-spike repeat. USDC and USDT have been pinned above 90% utilization for most of April. Another LRT or LST stress event under those conditions would repeat the April dispersion pattern.
- Spark’s deposit durability: Spark’s deposit base is the test of whether April’s migration was structural or opportunistic. Two consecutive months of positive net deposits would confirm the rotation.
- Curator concentration on Morpho: Whether the HHI stabilizes near 3,000 to 3,100, reverts, or continues rising past 3,200 to 3,300 will tell readers whether the vault economy is structurally consolidating around two or three managers.
- Kelp’s allocation decision: The combined WEETH and RSETH collateral position across the four protocols stands at approximately $5.4 billion. Kelp’s decision on whether to socialize the unbacked supply uniformly or isolate losses to L2 rsETH determines roughly $107 million of difference in implied bad debt on Aave V3 alone.
What April Showed
April showed two things in tension. First, DeFi lending’s containment infrastructure works. Aave’s risk framework activated within 90 minutes of detection of the rsETH event, contained the immediate exposure, and prevented the exploit from breaching the protocol’s contract surface.
The Protocol Guardian and Risk Steward functions executed within the operational windows for which the framework is designed. The system absorbed an external shock without bad-debt accumulation on the major protocols’ own balance sheets.
Second, the conditions that required containment have not changed. Bridge configurations like the one that was exploited on Kelp exist on other LRT and LST tokens. The composability that connects these tokens to lending markets remains a contagion vector that any future bridge stress can travel through.
weETH and rsETH together back $5.4 billion of collateral across the four protocols at the end of April, a larger position than before the event in nominal terms. The exposure to a templated repeat is structurally as likely as it was before April 18.
The lessons are infrastructural, not narrative. The exploit was not a flaw in DeFi lending mechanics or in restaking economics. It was a bridge configuration error. Aave’s contracts performed correctly. The infrastructure that propagated the event has not been changed by the event.
The April recovery on the rate side is real. The conditions that produced the bridge exploit have not been resolved.
The full April issue, with all charts, data tables, methodology, and section-by-section analysis across Aave V3, SparkLend, Morpho, and Fluid on Ethereum, is available on the Lending Terminal.
Each chart links back to a live dashboard module that reflects the April 30 snapshot by default and supports a Live Data toggle for current readings.
Read the full Issue №001 on the Lending Terminal
https://www.datumlab.xyz/lending-terminal/reports/2026-04-april
Issue №002 arrives June 7, 2026.
