Author: Vaidik Mandloi
Compilation: Saoirse, Foresight News
The underlying principles of all lending protocols in DeFi are largely similar: users deposit stablecoins or Ethereum into a shared liquidity pool, and borrowers draw funds from it after pledging assets; decentralized autonomous organizations (DAOs) vote to decide which assets can serve as collateral and their corresponding loan-to-value (LTV) ratios. Aave has developed a deposit scale of $500 billion precisely by relying on this model. For most of DeFi's development, this has been the industry's sole operating model, and its rationality has never been truly questioned.
However, on April 18, 2026, a hacker exploited a vulnerability in the LayerZero cross-chain bridge of the Kelp DAO project to forge rsETH tokens worth $292 million. The hacker deposited these counterfeit tokens into Aave as collateral to borrow real Ethereum. Within hours, the utilization rates of Aave's major mainstream lending markets reached 100%, meaning all available funds within the protocol had been fully borrowed. Over the next three and a half days, the platform lost $15 billion in deposits. Ultimately, Aave had to collaborate with various ecosystem parties to conduct a rescue, raising $160 million to cover the losses.
Although this vulnerability originated from the Kelp DAO project, the root cause of such massive losses lies in Aave's governance mechanism. As early as January of this year, a community vote decided to raise the collateral factor for rsETH to 93%, leaving only a 7% safety margin for such assets. It was this single decision that brewed one of the largest bank runs in the history of DeFi lending.
On the same day, some of the forged rsETH tokens also flowed into Morpho, the second-largest DeFi lending protocol. However, the risk exposure was only $1 million and dispersed across two independent, small isolated markets, failing to trigger a chain-reaction crisis.
Upon conducting in-depth research into this incident, I discovered that behind this event lies far more than a simple security attack.
Core Differences Between the Two Models
To understand why Aave hemorrhaged billions while Morpho remained largely unscathed, we must first clarify the fund placement and operational logic of the two protocol types.
When you deposit USDC into Aave, the funds flow into a single master liquidity pool, supporting lending activities for all community-approved assets like Ethereum and staked tokens. Depositors cannot choose the type of collateral asset their funds correspond to; all related rules are set by DAO votes. Therefore, when rsETH faced collapse risk, even ordinary users who had only deposited USDC and never touched rsETH found their assets frozen—everyone's funds were in the same risk pool, suffering collective losses.
Source: BingX
More critically, while the market was halted and users couldn't withdraw, Aave's governance layer actually lowered the borrowing rates for the frozen Ethereum markets, aiming to protect borrowers who had leveraged rsETH. Since deposit rates are directly linked to borrowing rates, depositors with the lowest risk and principal security saw their deposit yields shrink further.
In traditional credit systems, lenders with the lowest risk enjoy priority in repayment. However, Aave completely inverted this rule. The reason is that borrowers engaged in rsETH leveraged trading are also the most active voting group in community governance. When risk erupts, high-risk participants holding governance power naturally prioritize protecting their own interests.
Aave launched an insurance mechanism called Umbrella in late 2025, attempting to address such bad debt risks. Users could stake Ethereum; if the protocol incurred bad debts, the staked assets would be used for compensation. However, after the Kelp DAO crisis erupted, 18,922 out of 23,507 staked aWETH positions entered an unstaking waiting period, with nearly 80% of the insurance pool's funds withdrawing collectively.
This mechanism ultimately failed completely. On-chain insurance relies on voluntary user participation, and capital providers inevitably choose to exit when real risk materializes—after all, their assets only face substantial loss when a crisis occurs. This leads to such insurance often existing during peaceful times but becoming ineffective precisely when protection is needed.
Morpho's operational model is entirely different. It abandons the unified shared liquidity pool. Anyone can create an independent, isolated lending market, pre-setting the loan asset, collateral asset, price oracle, and interest rate model. Once parameters are deployed, they cannot be modified. To adjust risk levels, one can only create a new market.
Differences in underlying architecture between the traditional DeFi lending model (represented by Aave) and Morpho's "Morphological" model.
Furthermore, Morpho introduces independent risk management institutions (Stewards), such as Gauntlet and Steakhouse Financial. These entities establish vaults, allocate funds to different markets based on their own analysis, and charge performance fees; if losses occur, they are confined within their own vaults. Gauntlet also provided risk advice for Aave, but in Aave's system, its professional opinions were often overruled by token holders seeking high yields through voting, a situation Morpho prevents at its root.
The Overlooked Hidden Cost
Aave and Morpho are currently the two most widely applied lending models in the crypto space: Aave uses the shared liquidity pool model where all deposits are aggregated, with risk rules set by community votes; Morpho advocates the isolated market model, where each lending pair is independent, with risks managed autonomously by professional institutions.
The Kelp DAO vulnerability exposed the flaws and weaknesses of the shared pool model. But even during stable periods without security incidents, this model harbors a long-overlooked hidden cost. Aave's three core markets on Ethereum (Ethereum, USDT, USDC) contribute 89% of the platform's lending volume. In these three markets, deposit rates are consistently 25% to 35% lower than borrowing rates. This spread essentially represents idle funds lying dormant in the liquidity pool; depositors cannot profit from them, yet borrowers still bear the full borrowing cost.
The interest rate mechanism adjusted based on utilization rates can push rates higher when risk increases but cannot activate idle funds when lending demand is low, leaving large amounts of assets stranded in the pool generating no yield. In these three markets alone, the annual value erosion due to idle funds amounts to approximately $52 million, close to a quarter of Aave's annualized revenue for one quarter. Even zeroing out the reserve ratio and canceling platform fees cannot solve the idle fund issue—it's an inherent shortcoming of the shared pool architecture.
Morpho's interest rate model aims to maintain a utilization rate of around 90%, significantly higher than Aave's 60% to 80% range. This model can sustain high utilization because deposits within the platform are not re-used as collateral for other loans, avoiding chain-liquidation risks at the source and thus eliminating the need to reserve large amounts of capital as a risk buffer. When lending demand is strong and funds are heavily borrowed, rates automatically increase, attracting more depositors; when lending demand is weak, rates decrease, stimulating borrowing. The entire system achieves dynamic balance without requiring community votes.
Source: Gate.com
Actual data confirms its advantage: even after deducting Steward fees, the yield offered to depositors by Morpho's top USDC vaults still exceeds that of Aave and Compound. Currently, Morpho's deposit-to-loan ratio is 41%, while Aave's is 39%, and the former's scale reaches tens of billions of dollars, meaning the yield advantage benefits all depositors on the platform day after day.
Institutional Choice: Which is More Trustworthy?
Surprisingly, all of Coinbase's crypto asset lending services are built on Morpho. The related loan scale has now surpassed $2 billion, and over 100 million platform users are indirectly enjoying the returns provided by Morpho.
Most users aren't even aware they are using DeFi services. Coinbase did not develop its own lending system nor choose another platform. The core reason is that Morpho's underlying architecture allows the platform to independently set risk parameters, select partner risk institutions, and maintain full control over the entire product experience.
Apollo Global Management, a global asset manager with over $1 trillion in assets under management and 30 years of experience in private credit, recently signed a four-year cooperation agreement, planning to acquire up to 90 million MORPHO tokens, accounting for 9% of the total token supply. The institution is connecting its tokenized fund assets to Morpho as collateral, with Gauntlet responsible for vault management and market stress testing.
Beyond that, Anchorage Digital, the first federally chartered native crypto bank in the US, has connected its institutional clients managing hundreds of billions to Morpho vaults; SG-FORGE, the compliant arm of French banking giant Société Générale, is the first licensed bank to implement DeFi lending business through Morpho.
These heavily regulated traditional financial institutions collectively chose Morpho, with a highly consistent core demand: the isolated market model allows them to meet their own compliance and risk control requirements without relying on DAO decisions. In contrast, all market rules in Aave inevitably involve community voting, completely incompatible with institutions' need for autonomous control.
Changes in the regulatory environment have further amplified this trend. The US "GENIUS Act" stipulates that stablecoin issuers cannot directly distribute investment returns, meaning stablecoin institutions require neutral underlying infrastructure to activate vast amounts of idle assets. US-related projections show that by 2028, the scale of stablecoin reserves invested in US Treasury bonds will surge from the current $120 billion to over $1 trillion. This massive pool of capital urgently needs a lending foundation that allows asset custodians to control their own risks, and Morpho is currently the most fitting choice.
