Author: Cooper Duschang
Compiled by: Deep Tide TechFlow
Deep Tide Guide: Someone is draining $190 million in liquidity from Aave's USDC pool every night and returning it half an hour later—this operation is forcing all borrowers to pay an extra $6 million in interest annually. Deep Tide tracked the on-chain flow of funds and found this is most likely a mandatory daily process for a certain fund to prove to its investors that "we indeed hold this money." The transparency of DeFi has exposed the invisible tax that traditional financial compliance processes impose on on-chain users.
Core Discovery
Since May, the utilization rate of Aave's USDC pool has been spiking daily during the midnight UTC period. The reason is that someone withdraws $190 million USDC around 23:30 and deposits it back within an hour. This affects the interest rates for all lenders and borrowers in the pool.
By tracing the fund flow from this wallet, we found the behavior most consistent with the explanation: a certain institution needs to withdraw funds from the DeFi pool daily to take a snapshot proving asset ownership, and then deposit them back.
This "pump-and-dump" time window has become increasingly tight in July, consistently centered around midnight UTC. Compared to a scenario with no liquidity withdrawal, this operation is causing all USDC borrowers to pay an extra $6 million per year.
How Does Aave's Utilization Mechanism Work?
Aave's dual-interest rate model incentivizes borrowing and lending based on a target utilization rate. When utilization is below the target, the interest rate increases slowly; when it exceeds the target, the rate spikes sharply. The utilization formula is (Total Borrowed / Total Deposited). For example, the more assets borrowed, the closer the utilization gets to 100%.
Figure: Aave's dual-interest rate model—the borrowing rate curve steepens sharply after exceeding the target utilization rate (e.g., 92%). Source: Coin Metrics / Talos
The target utilization rate for the USDC market on Aave's Ethereum main instance is 92%. After exceeding the target, the interest rate curve becomes very steep—from 92% to 100% utilization, the borrowing rate skyrockets from 4% to 14%. This discourages borrowing demand or encourages more people to deposit USDC to meet the demand.
The utilization rate in Aave's USDC market typically fluctuates around 90%. However, since May, minute-level data shows repeated sharp spikes in utilization.
Figure: Minute-level data of Aave USDC market utilization, showing regular midnight spikes since May. Source: Coin Metrics / Talos
Why Do These Spikes Occur?
Excluding governance adjustments or oracle manipulation, only two variables affect the utilization rate: the amount of USDC deposited and the amount borrowed.
Apart from a brief dip in borrowing, the total borrowed amount has averaged $1.89 billion since June 27th. If borrowing hasn't consistently surged—which would push utilization higher—then the amount of USDC deposited must be plummeting.
Between 23:30 UTC and latest 00:30 UTC, over $150 million in USDC deposits are withdrawn and redeposited. The available borrowing liquidity plummets from about $210 million to as low as $33,000.
Figure: Over $150 million USDC withdrawn and redeposited daily between 23:30–00:30 UTC, available liquidity crashes from ~$210 million to a low of $33k. Source: Coin Metrics / Talos
Who Is Creating These Spikes?
Ethereum's pseudonymity allows us to publicly track addresses and transactions without exposing the user or intent. We found the address moving $190 million every night: 0x56957E411Ea83a0B4A0689C1fB0D1e5eA0d20149.
Figure: Fund flow path of the involved address 0x5695...0149, withdrawing liquidity from Aave for a snapshot each night before returning it. Source: Coin Metrics / Talos
This account received funds on December 5th, 2025. Examining balance changes and fund flows, we traced that the target address performed similar operations on Aave's PYUSD pool in December and January. The target address receives USDC, deposits it into the Aave pool, withdraws around 23:30 UTC, and sends it to 0x31173Ed183e5a9450C3671018ec4d770c8A8bF18 a few minutes later. The USDC is then returned shortly after 00:00 UTC and redeposited into the Aave pool.
This "coordinating wallet" 31173e...bf18 receives funds from the target address and another address holding sUSDS by depositing USDC to earn yield. This combined capital is sent nightly to a third, upper-level wallet: 0xf1edbf98dda764ec51de3776371f0f7d6f6156a8.
This is likely a process where an investor is required to prove their holdings daily by withdrawing liquidity from DeFi pools for snapshot purposes.
From June to July, the average time window for pumping and dumping has tightened. The withdrawal time shifted from 23:20 to 23:34, and the return time shortened from 00:34 to 00:09. The average interval between withdrawal and return was 259 blocks in June, shrinking to 177 blocks in July.
Figure: The withdrawal and return time window tightened from June to July, with the interval shortening from an average of 259 blocks to 177 blocks. Source: Coin Metrics / Talos
What Is the Impact on Borrowers?
The utilization spikes caused by liquidity withdrawal benefit depositors but harm borrowers. When utilization spikes, the floating borrowing rate also spikes, leading to temporarily higher repayments calculated per block.
Yield or interest on Aave is streamed per block. With an average Ethereum block time of 12 seconds, about 5 blocks are produced per minute. We decomposed the floating borrowing APR to simulate how a $1 million borrowing position is affected by minute-by-minute changes in the borrowing rate.
Figure: Minute-by-minute borrowing rate changes for a $1 million borrowing position during liquidity withdrawal, costing an extra ~$9 per night over 18 days. Source: Coin Metrics / Talos
Over 18 days, when liquidity was withdrawn, a borrower with a $1 million position paid an average of $9 more per day compared to a simulated scenario where liquidity was not temporarily altered. This would amount to a loss of about $3,280 annually. For the total $1.89 billion borrowed in the USDC pool, this costs all borrowers an extra $17,000 per night, or $6 million per year. Borrowers are paying more for activities unrelated to their own loans.
Why Does This Matter?
We believe these consistent utilization spikes most closely align with an explanation of a fund proving its holdings. Establishing regulations and improving workflows around DeFi investments could help reduce these negative impacts on lending pools. The transparency of blockchain can aid in tracking fund flows within blockchain protocols without needing to send funds to a designated address to prove they exist and are under the control of approved parties.
Today, lenders and borrowers must monitor not only the health of their own positions but also those in the entire pool. Tracking funds and deciphering their intent can help assess new risks and predict liquidity and interest rate changes.
