What started as an exploit on rsETH (an asset hosted on AAVE, not the protocol itself) has snowballed into the worst functional crisis DeFi has ever seen. AAVE's token is down over 20% in 24 hours. And that might be the least of the problems.

Here's the ugly dynamic: AAVE's core markets are at 100% utilization. That means users literally cannot withdraw their assets. The money is there, it's just locked. Classic bank run mechanics, DeFi edition. Users are fleeing through GHO, DAI, and secondary stablecoins, but the cascade is bleeding liquidity across other internal markets too.

Bad debt could exceed $200 million. It's still unclear who will absorb it, but markets are already pricing in the likelihood that AAVE itself will have to step in.

There's no quick fix in sight. No one wants to deposit capital that could get stuck for an unknown period of time. The only real path out involves significant capital injections to bring utilization back below 100%, and even that is uncertain timing.

This is also the largest DeFi hack of 2026, hitting at the worst possible moment: AAVE was deep into a major overhaul of its revenue and asset management strategy. The reputational damage compounds the liquidity damage.

DeFi has weathered exploits before. But a full functional freeze of this scale, where the protocol works but users are effectively locked out, is uncharted territory. How AAVE handles the next 72 hours may define the next chapter of decentralized finance.