CDOR interest rates soar to 15%: Analysis of Aave lending pressure and changes in DeFi interest rate structures

On April 18, 2026, an attack aimed at the Kelp DAO cross-chain bridge ultimately left a deep scar on Aave—this leading lending protocol that has never previously suffered a smart contract security incident. The attacker minted approximately 116,500 rsETH out of thin air, then deposited it as collateral into Aave, borrowed a large amount of real ETH, and disappeared. Aave’s total value locked (TVL) plunged from about $26.4 billion to roughly $18 billion within two days, evaporating more than $8 billion. Meanwhile, the lending interest rate for stablecoins on the Aave platform surged to 15%, and the CoinDesk overnight rate (CDOR), which uses Aave as its underlying benchmark, also reached the highest level since 2024.

On one side is a cliff-like drop in TVL and looming clouds of bad debt; on the other, there is a rare high-yield situation in which stablecoin deposit rates are nearing 14%.

How an attack that never touched smart contracts could shake the largest DeFi lending protocol

At 17:35 UTC on April 18, 2026, the rsETH cross-chain bridge built by Kelp DAO using LayerZero technology was attacked. Within 46 minutes, the attacker forged cross-chain messages and illegally released about 116,500 rsETH from the Ethereum mainnet, valued at approximately $293 million at the time and accounting for about 18% of the token’s total circulating supply.

The size of this attack made the Kelp DAO incident the largest single DeFi protocol attack so far in 2026.

After the attack, Aave’s protocol guardians and risk administrators immediately froze the rsETH and wrsETH reserves in all 11 markets, set LTV to zero, and reduced multi-chain WETH interest rates, freezing WETH borrowing. Aave founder Stani Kulechov confirmed that Aave’s smart contracts themselves were not attacked, and that the protocol logic was running normally.

Although the attack did not reach Aave’s core contracts, the incident exposed a structural risk in DeFi composability that had long been underestimated: a configuration flaw in an external protocol can propagate through the collateral chain, triggering a liquidity crisis and the accumulation of bad debt in a large-scale lending system like Aave. The protocol itself was not breached, but the break in the credit of upstream assets transmitted directly to downstream liquidity pools.

From bridge vulnerabilities to systemic contagion

Complete timeline of the event:

The reason this attack was able to quickly propagate to Aave’s core lending pool is closely tied to Aave V3’s efficient high-LTV E-Mode borrowing model. After the attacker used rsETH as collateral to enter E-Mode, they could borrow WETH with an LTV of up to 93%, nearly achieving a close to 1:1 asset-swap efficiency. This efficiency is a design innovation meant to optimize capital efficiency under normal market conditions, but when collateral credit breaks down, it becomes an accelerant for amplifying losses.

On-chain dissection of bad debt scale, interest rate anomalies, and fund flows

A cliff-like collapse in Aave’s TVL

Before the incident, Aave TVL was about $26.4 billion; after the incident, within two days it dropped to about $18 billion, a decrease of more than 31%. According to data from on-chain analysts, Aave saw daily capital outflows of $6.6 billion, of which stablecoins accounted for $3.3 billion. In the same period, total DeFi TVL across all chains fell from about $99.49 billion to $86.29 billion, a reduction of about $13.2 billion.

In Aave V3, the utilization rate of the USDT and USDC liquidity pools once reached 100%, meaning all borrowable assets in those pools were fully borrowed out, and depositors could not withdraw funds temporarily.

Two-scenario estimation of bad debt scale

According to a report released by LlamaRisk, a risk service provider, the scale of bad debt Aave faces varies into two scenarios depending on how losses are allocated:

• Scenario 1 (socialized across the whole system): Estimated bad debt of about $123.7 million, with the Ethereum Core market under the greatest pressure.
• Scenario 2 (losses limited to L2): Estimated bad debt of about $230.1 million, with Mantle facing a WETH reserve shortfall as high as 71.45%, and Arbitrum at 26.67%.

Aave DAO’s treasury currently holds assets worth about $181 million. Under Scenario 1, it has full coverage capacity; under Scenario 2, there is a funding gap of about $49 million, which requires relying on additional reserves or external support.

CDOR interest rate surges to 15%

Large-scale capital withdrawal caused deposit rates for USDT and USDC on the Aave platform to rise to 13.4%, while borrowing rates climbed as high as 15%. CoinDesk Overnight Rate (CDOR)—a benchmark calculated based on the stablecoin floating borrowing and lending pools in Aave V3’s core markets and published by CoinDesk Indices—also rose to the highest level since 2024, reaching 15%.

CDOR was designed to provide a standardized overnight interest rate benchmark for stablecoin money markets, supporting hedging for the cost of funds, yield locking, and the development of cross-currency interest rate strategies. Under normal market conditions, it typically fluctuates in a range of 2% to 5%. The current level of 15% is 3 to 7 times the usual range, reflecting an extreme imbalance between liquidity supply and demand.

Capital flows—structural migration from Aave to Spark

While Aave experienced large-scale capital outflows, other major lending protocols in the market showed markedly different capital flow trends:

• Aave: Total deposits fell from $48.5 billion to $30.7 billion within three days, a net outflow of about $15.1 billion and a drop of about 31%.
• Morpho: From $11.7 billion to $10.2 billion, a net outflow of about $1.5 billion, with relatively limited impact.
• Spark (SparkLend): TVL grew against the trend, rising from $1.9 billion to $3.2 billion, a net inflow of about $1.3 billion.

This data clearly reveals how market participants diverged in their risk perception: some institutional capital withdrawing from Aave chose to migrate to alternative platforms viewed as relatively safer, with Spark becoming the biggest beneficiary.

Public sentiment analysis: How different parties assess Aave’s recovery prospects

Assessments by mainstream analysts:

DefiLlama founder @0xngmi proposed two scenario analyses. Depending on how the approximately $71 million worth of ETH frozen by Arbitrum is handled, Aave’s bad debt range could fluctuate between $17 million and $341 million, and he believes that by using the protocol treasury and necessary adjustments, affected protocols can “fully recover.”

Dragonfly managing partner Haseeb Qureshi said, “AAVE may need to absorb some bad debt, but it has enough net assets to repay it.”

Blockworks Research’s analysis pointed out that the Kelp incident exposed a structural risk in unified liquidity pools: in a single lending pool, losses could be “socialized” across all depositors, leading to a systemic underestimation of the risk of particular types of collateral.

Quantified market sentiment indicators:

Based on Gate market data, as of April 23, 2026, the price of the AAVE token was $91.64, with a -1.95% change over 24 hours and $7.76 million in 24-hour trading volume. AAVE’s market cap was $1.38 billion, and its fully diluted market cap was $1.46 billion, giving a ratio of 94.85% between market cap and fully diluted market cap. Over the past 7 days, it fell 13.81%; over the past 30 days, it fell 16.27%; and over the past year, it fell 42.05%.

The core points of disagreement:

Differences in the market about Aave’s recovery prospects mainly focus on three dimensions:

First, the boundary of bad debt coverage capability. The optimistic view is that Aave’s treasury (about $181 million) is enough to cover Scenario 1’s $123.7 million bad debt; the pessimistic view worries that if losses materialize according to Scenario 2 ($230.1 million), the treasury shortfall could trigger stkAAVE stakers to bear the remaining losses.

Second, the time window for liquidity recovery. Some analysts believe the deadlock caused by 100% pool utilization could last for weeks, during which depositors’ withdrawal rights are effectively “on hold.” Others believe that the high CDOR rate of 15% itself is the most effective market regulator, which will attract yield-seeking capital back.

Third, the permanent loss of market share. Aave lost about $15.1 billion in deposits within 3.5 days, while Spark absorbed about $1.3 billion over the same period. Whether this indicates a structural reshuffling in the DeFi lending market still needs to be validated by subsequent data.

Industry impact analysis: How the formation mechanism of the CDOR arbitrage window reveals structural implications

On-chain breakdown of the arbitrage logic:

A CDOR level of 15% creates an arbitrage window for stablecoin holders that is rare even in DeFi history. The core logic is as follows:

Depositing USDC/USDT yields about a 13.4% annualized return, while the stablecoin equivalent yield in traditional financial markets (such as money market funds) is typically between 4% and 5%. This interest-rate spread of roughly 8 to 9 percentage points forms the basis for arbitrage.

However, arbitrageurs must evaluate three key risk dimensions at the same time:

First, liquidity lock-up risk. With the current 100% utilization rate in Aave V3 stablecoin liquidity pools, newly deposited funds can earn high interest immediately, but withdrawals require waiting for borrowers to repay or for new deposits to flow in. This means arbitrageurs effectively take on the risk of liquidity maturity mismatch—the high yield comes at the cost of uncontrolled exit timing.

Second, uncertainty in the bad debt backstop mechanism. If Aave ultimately covers bad debt using Umbrella safety modules or treasury funds, depositors’ principal security would not be affected; but if losses are partly socialized across depositors, the current high interest rates might not be enough to compensate for potential losses at the principal level. This uncertainty is the main obstacle that constrains large-scale arbitrage capital from entering.

Third, the sustained cycle of interest rates. High rates are the result of liquidity tightening rather than an indicator of the protocol’s profitability. Once a solution for bad debt becomes clear or market confidence recovers, deposit rates could drop back to normal within a matter of hours. Arbitrageurs need to judge precisely how long this window will last.

Structural changes in the competitive landscape of DeFi lending protocols:

The impact of the Kelp event on the DeFi industry may be far beyond the single attack itself. Blockworks Research’s analysis suggests that Aave’s significant deposit outflows may mark the first real, substantial crack in its liquidity moat. If depositors increasingly view “risk isolation” as a product feature worth paying for, the recent event could accelerate a structural reallocation of capital among lending protocols.

Meanwhile, Aave V4 is expected to go live in mid-2026. Its “center-radiation” architecture will strengthen cross-chain settlement capabilities and institutional-grade compliance frameworks. The time gap between the V4 rollout and the current crisis recovery cycle will be a key observation point for assessing how Aave’s competitive strength is repaired.

Conclusion

The crisis Aave has experienced is, in essence, an extreme stress test of DeFi’s composability paradigm. The protocol’s core contracts were not breached, but the credit fracture of upstream assets propagated through the collateral chain, triggering a chain reaction within a lending system at the scale of billions of dollars. This serves as a reminder to the industry: in the world of DeFi, a protocol’s security depends not only on the robustness of its own code, but also on how it connects to the broader ecosystem and the design of its risk transmission paths.

The surge of CDOR to 15% is both an alarm for the crisis and a signal that the market is initiating self-repair. High interest rates are playing the role of a liquidity regulator: they punish excessive borrowing behavior, reward depositors willing to take on liquidity lock-up risk, and ultimately guide funds back. Whether a balance can be found between resolving bad debt and restoring market confidence will determine the next direction of evolution for Aave—and for the entire DeFi lending track. For market participants, understanding the full logical chain behind this event is far more valuable in the long run than chasing short-term interest-rate fluctuations.