BroadChain, April 27, 2026 - Two weeks ago, KelpDAO suffered a $292 million cross-chain bridge attack, with risks spreading to Aave, resulting in approximately $196 million in bad debt. Aave's total value locked plummeted from $26.4 billion to $17.9 billion within three days. Three weeks prior, Solana ecosystem's Drift Protocol lost $285 million due to a social engineering attack by North Korean hackers. The two incidents combined for a total loss of $577 million.
In Aave's USDC lending market, capital utilization remained as high as 99.87% for four consecutive days, with deposit rates surging to 12.4%. Circle's Chief Economist Gordon Liao even initiated a governance proposal to quadruple the borrowing limit to alleviate withdrawal pressure. However, just a month ago, many users depositing stablecoins in this market were earning only 4%-6% annualized returns.
On the Blockworks podcast, Santiago R Santos raised a core question: DeFi users have long borne high risks without ever receiving adequate risk compensation. In traditional finance, corporate bond yields are composed of the risk-free rate, expected loss (default probability × loss given default), risk premium, and liquidity premium. Moody's data shows that the long-term average annual default rate for US speculative-grade bonds is 4.5%, with a historical average recovery rate of about 40% for senior unsecured high-yield bonds, corresponding to an expected loss of 2.7%.
In comparison, Aave's USDC deposit rate is around 5.5%, falling between investment-grade bonds and single-B high-yield bonds. Meanwhile, Morpho's curated vault yields approximately 10.4%. These two figures cannot simultaneously accurately reflect the same underlying risks. DeFi has three unique default modes that do not exist in traditional finance: smart contract vulnerabilities, oracle manipulation, and governance attacks—risks that are not fully accounted for in traditional pricing models.