Bad Debt in DeFi: How It Forms and Who Pays for It

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Bad debt is a loan its collateral can no longer cover, even after liquidation. It forms through failed liquidations, bad oracles, depegs and exploits, and lenders, stakers, curators or DAO treasuries absorb it, depending on the protocol's backstops.

Watch: Bad Debt in DeFi: How It Forms and Who Pays for It 1:45

Video transcript

Bad debt is a loan its collateral can no longer cover, even after liquidation. Who pays depends on the protocol's backstops.

Liquidators should repay unhealthy loans in time. But as Morpho's docs warn, no one has to, and unrealized debt keeps accruing interest.

Bad debt forms five ways. Liquidations fail, thin markets outrun liquidators, and oracles keep a stale price. Collateral depegs, or an exploit brings in stolen collateral.

In April 2026, an attacker borrowed against stolen rsETH on Aave. LlamaRisk first modeled up to 230.1 million dollars of possible bad debt, then revised it lower.

Months earlier, Stream Finance's xUSD fell to 26 cents, and curated vaults passed losses to depositors. Neither began with a bug in the lender's code.

Backstops decide who pays. Morpho suppliers share losses, Aave's Umbrella slashes stakers, and Kamino curators take first loss. Treasuries and coalitions like DeFi United step in case by case.

To cap bad debt, size supply caps to exit liquidity, price at market and isolate markets. Keep freezes fast and fund a published first-loss layer.

Watch the signals: health factors bunched near one, full utilization, backing below borrowing, and stakers heading for the exit.

Guardian's allocator ratings score each position from zero to 100, and monitoring moves the score when a protocol changes. Read the full article, or talk to Guardian at guardian.security.

In April 2026, stolen rsETH reached Aave as collateral. LlamaRisk, an Aave risk provider, first modeled $123.7M to $230.1M of possible bad debt.

Months earlier, Stream Finance's xUSD collapsed. Curated vaults that lent against it passed the losses to their depositors.

Neither started with a bug in the lender's own code. This guide covers how bad debt forms, who pays for it and the controls that cap it.

What Bad Debt Means Onchain

Lending markets ask borrowers for more collateral than they borrow. When a loan gets too close to its collateral's value, liquidators repay it and take collateral at a discount.

Bad debt is what remains when the collateral is worth less than the debt and liquidation cannot close the gap.

Liquidation is not guaranteed. Morpho's docs put it plainly: "Anyone can liquidate an unhealthy position, but no one has to."

Until someone does, the debt sits unrealized and keeps accruing interest. Once realized on Morpho, "the market books the residual debt as a loss to its suppliers."

Five Ways Bad Debt Forms

Cause	What goes wrong	Example
Liquidation failure	No one liquidates, or the liquidation reverts	Morpho: "no one has to" liquidate
Fast or thin markets	Prices move faster than liquidators can trade	CRV on Aave, November 2022
Oracle errors	The oracle keeps a stale or fundamental price	Stream's tokens, November 2025
Depegs and lost backing	Collateral loses most of its value	xUSD, about 95% depegged
Exploits	Stolen collateral, or a broken solvency check	rsETH, April 2026; Resupply, June 2025

In November 2022, a trader's CRV short on Aave peaked at about 92M CRV, per Llama and Gauntlet. CRV rose 75% within hours, CoinDesk reported.

The position was fully liquidated, yet Aave was left with about $1.6M of bad debt.

In the Stream collapse, some positions were not liquidated because "many markets use fundamental value oracles rather than spot prices," Coinspeaker reported.

At Resupply, a donation inflated an empty vault's share price, and an exchange rate rounded down to zero. The attacker's loan then read as zero LTV and passed the solvency check.

Resupply's post-mortem says the exploit "created $10M of reUSD bad debt."

Code-level causes, from reverting liquidations to unpayable fees, are in our guide to liquidation vulnerabilities.

Two Case Studies: rsETH and xUSD

rsETH on Aave, April 2026

On April 18, 2026, an attacker took 116,500 rsETH from Kelp DAO's bridge. Our Kelp DAO breakdown covers how.

The attacker supplied 89,567 rsETH to Aave and borrowed 82,650 WETH and 821 wstETH, per LlamaRisk. Health factors sat around 1.01 to 1.03.

Aave's Protocol Guardian began freezing rsETH and wrsETH reserves around 19:00 UTC that day. LlamaRisk states: "Aave's smart contracts were not compromised at any point during this event."

The bad debt depended on who would bear rsETH's backing gap. LlamaRisk modeled two cases:

If the loss is	April 20 estimate	April 22 update
Shared by all rsETH	$123.7M	$62.4M
Isolated to L2 rsETH	$230.1M	$162.5M

The update assumed 30,766 ETH frozen by Arbitrum's Security Council would return to rsETH's backing.

By May 9, liquidations had recovered 106,993 rsETH, 89,567 of it from Aave. LlamaRisk said the remaining rsETH was "to be covered by the DeFi United coalition's committed ETH."

TokenLogic proposed 25,000 ETH from the Aave DAO treasury toward that coalition.

xUSD on curated vaults, November 2025

On November 3, 2025, Stream Finance said an external fund manager had lost about $93 million of Stream fund assets. It suspended withdrawals and deposits.

xUSD traded at $0.26 on CoinGecko by November 4, Decrypt reported. Coinspeaker cited an analyst's estimate of $284.96 million in loans secured by Stream's tokens.

The losses reached lenders through curated vaults and markets:

MEV Capital's USDC vaults on Morpho, exposed to xUSD and Elixir's sdeUSD, took 3.5% and 12% haircuts, per Protos.
Euler says its Plasma deployment was "effectively wiped out."
Euler says depositors left behind as curators exited were "in markets with depleted liquidity."

Our vault curator risk guide traces where each loss landed.

Who Absorbs the Loss

These are the backstops in use today, and who each one makes pay:

Backstop	Who pays	Example	Limit
Socialized loss	Market suppliers or vault shareholders	Morpho markets and Vault V2	Early leavers can escape it
Staked backstop	Stakers, after a DAO first-loss offset	Aave Umbrella	Same asset only; Ethereum only
Legacy safety module	stkAAVE and stkABPT stakers	Aave Safety Module	Slashing to be disabled as Umbrella scales
Curator first loss	Curator capital, matched by Kamino, then depositors	Kamino Insurance Pool	Manual payout; capped at pool balance
DAO treasury	Token holders, via treasury spend	Aave's CRV repayment; Resupply	Discretionary, and limited by the treasury
Industry coalition	Other protocols and DAOs	DeFi United for rsETH	Ad hoc; depends on pledges

In a Morpho Vault V2, no shares are burned: every holder takes the loss through a lower share price. Morpho warns that early withdrawers can leave at an inflated price before bad debt is realized.

Umbrella stakers can lose up to their full stake in extreme cases, and funds stay slashable through a 20-day cooldown. During the rsETH event, LlamaRisk noted Umbrella covered Ethereum Core reserves only.

Kamino matches a curator's Insurance Pool deposit up to $250K. The pool "absorbs the loss first, up to its full balance," then depositors take the rest.

Treasuries step in case by case. For the CRV debt, Llama and Gauntlet proposed treasury funds rather than the Safety Module, and AIP 144 bought 2.7 million CRV.

After its exploit, Resupply's treasury repaid 643,051 reUSD of the bad debt.

Our Aave risk review covers how Umbrella replaces the legacy Safety Module.

Design Controls That Cap It

Size caps to exit liquidity. Supply caps and LTVs should match what liquidators can actually sell.
Price at market, with limits. Know when a fundamental-value oracle stops liquidations.
Isolate markets. One bad collateral should not reach lenders in unrelated markets.
Keep freezes fast. Aave began freezing rsETH reserves the same day as the theft.
Cap issuers and bridges. Limit exposure to any one issuer or cross-chain route.
Fund first loss. Publish the backstop's size, trigger and coverage.
Stop phantom interest. Morpho suggests setting a vault's maxRate to 0 while debt is unrealized.

Signals Before Bad Debt Lands

Health factors bunched near 1. The rsETH positions sat at 1.01 to 1.03.
Utilization at 100%. MEV Capital's xUSD market on Arbitrum hit 88% borrow rates at full utilization, Coinspeaker reported.
Backing below borrowing. A trader estimated about $170M behind xUSD against $530M of borrowing, Decrypt reported.
Concentration. Coinspeaker put TelosC's loans secured by Stream assets at $123.64 million.
Stakers heading for the exit. LlamaRisk counted 18,922 aWETH entering Umbrella's cooldown.
App warnings. Morpho's app flags bad_debt_unrealized on affected markets and vaults.

How Guardian Helps Allocators

Guardian's risk ratings for capital allocators underwrite a position on its deployed code, who controls it and everything it depends on to stay solvent.

That includes economic failure paths: liquidation behavior, pricing assumptions, liquidity depth and correlation. Oracles, bridges and upstream protocols are "assessed as inherited exposure."

Each position gets a score from 0 to 100. Guardian monitoring moves the score when the protocol changes, and you hear about it that day.

Frequently Asked Questions

What is bad debt in DeFi?

Debt that collateral can no longer cover, even after liquidation. It appears when collateral falls faster than liquidators act, or is mispriced, depegs or loses its backing, and the shortfall stays on the protocol's books.

Who pays for bad debt in DeFi lending?

It depends on the protocol. On Morpho, market suppliers or vault shareholders absorb it. Aave's Umbrella slashes stakers after a DAO first-loss offset. Curators, DAO treasuries and industry coalitions have also covered losses.

Did Aave take bad debt from the rsETH exploit?

LlamaRisk first modeled $123.7M to $230.1M, then $62.4M to $162.5M, assuming 30,766 frozen ETH returned to rsETH's backing. By May 9, liquidations had recovered 106,993 rsETH, and the DeFi United coalition committed ETH for the rest.

How do lending protocols prevent bad debt?

With conservative LTVs and caps, market-price oracles, isolated markets, fast freezes and a funded first-loss layer. Watching health factors, utilization and collateral backing gives time to act before losses land.

Sources

Know your exposure before bad debt lands

Guardian scores each lending position on its code, controls, oracles and economic failure paths, then tells you the day any of them changes.

Talk to Guardian