Aave vs Morpho: Two Divergent DeFi Lending Architectures

Author: Vaidik Mandloi; Source: TokenDispatch; Translation: Shaw, Golden Finance

All decentralized finance (DeFi) lending protocols operate on roughly the same logic: users deposit stablecoins or ETH into a shared liquidity pool, borrowers pledge collateral and then can withdraw funds from the pool; a decentralized autonomous organization (DAO) determines which assets can be used as collateral and the corresponding collateralization ratios. Based on this model, Aave's deposit scale once soared to $50 billion. For most of DeFi's development, this was the industry's only mainstream solution, and its operational mechanism was never truly questioned.

But on April 18, 2026, a hacker exploited a vulnerability in KelpDAO's LayerZero cross-chain bridge, forging and issuing false rsETH tokens worth $292 million. The hacker deposited these fake tokens as collateral into Aave to borrow real ETH. Within just a few hours, the utilization rate across major lending markets on Aave reached 100%, meaning all available funds within the protocol had been fully loaned out.

Over the following three and a half days, the protocol lost up to $15 billion in deposits. Ultimately, Aave had to initiate a joint rescue operation, raising $160 million from various ecosystem parties to cover the losses.

The root cause of this vulnerability was in the KelpDAO project, but the losses were entirely borne by Aave's governance system. The reason traces back to January of this year, when the community voted to raise the loan-to-value ratio (LTV) of rsETH to 93%, leaving only a 7% safety buffer for this type of collateral. This decision ultimately triggered an unprecedented run on the decentralized finance lending sector.

On the day of the incident, some of the illegally minted rsETH tokens also flowed into Morpho, the second-largest DeFi lending protocol. However, the platform's related risk exposure was only $1 million, dispersed across two small independent markets.

I have researched this incident for a long time and believe that there is far more behind it than a simple vulnerability attack.

Differences

To understand why Aave lost $15 billion while Morpho was barely affected, we first need to clarify the two types of protocol deposit operation models.

When users deposit USDC into Aave, the funds enter a single shared liquidity pool. This pool provides lending support for ETH, pledged tokens, and various collateral assets approved by governance. Depositors cannot choose the specific collateral type for their funds; all rules are set entirely by the DAO through internal voting.

Therefore, when the price of rsETH collapses, even USDC depositors who have never interacted with such assets will find their funds locked. All funds are pooled together, and once the assets in the pool are drained, all depositors are affected.

What I find most unacceptable is that, during a market freeze when depositors cannot withdraw their tokens, Aave's governance actually lowered the interest rate for the Ethereum (WETH) lending market to protect borrowers leveraging rsETH.

Since Aave's deposit yields are directly linked to the interest paid by borrowers, depositors holding ETH and stablecoins—who have the lowest risk exposure—end up seeing their returns further shrink.

In traditional credit systems, the highest-priority, lowest-risk creditors are paid first. But Aave has completely reversed this rule. The reason is that borrowers using rsETH to leverage are also the most active participants in governance. This leads to a situation where, in times of risk, the group bearing the highest risk has the greatest influence to protect their own interests.

At the end of 2025, Aave launched a new insurance mechanism called Umbrella to prevent such asset losses. Users could pledge ETH (WETH), with the agreement that if the protocol incurs bad debt, the pledged assets would be confiscated. During the Kelp crisis, 23,507 aWETH tokens were pledged in the insurance pool, with 18,922 of them in the withdrawal cooling-off period—accounting for nearly 80% of the insurance pool at that time, leading many users to flee en masse.

This insurance mechanism ultimately failed. Essentially, on-chain insurance relies on voluntary participation, and fund providers can withdraw their funds at any time. When a crisis hits, it is precisely their principal that faces substantial risk, prompting everyone to withdraw. This means such insurance often only functions in calm conditions and is effectively useless during crises.

Morpho's operational model is entirely different. The platform does not use a unified shared liquidity pool; anyone can create independent lending markets with fixed rules: lending assets, collateral assets, price oracles, and interest rate models. Once deployed, these parameters cannot be changed. To adjust risk exposure, new markets must be created.

In addition, Morpho has introduced independent risk control institutions, such as Gauntlet and Steakhouse Financial. These entities set up funds, rely on proprietary analysis models to diversify funds across Morpho's various markets, and charge performance fees. If losses occur, only their own funds bear the losses. Gauntlet has also provided risk management advice to the Aave governance team, but such suggestions are often vetoed by token holders seeking high yields, whereas Morpho avoids this issue.

Hidden Costs

Aave and Morpho are currently the two most widely used crypto lending models. Aave uses a shared liquidity pool model, where all deposits go into one pool, and risk rules are decided by governance votes. Morpho employs an independent market model, where each lending pair is isolated and risk is managed by professional risk control firms.

The KelpDAO vulnerability exposed the flaws and loopholes in the shared liquidity pool model. Even without security incidents, this model has an often-overlooked hidden cost. Currently, the combined borrowing scale of Aave's three major Ethereum markets (WETH, USDT, USDC) accounts for 89% of the protocol's total loans. In these markets, deposit yields have long been 25% to 35% lower than lending interest rates. The interest rate spread means that the idle funds in the pool are always unproductive: depositors cannot earn returns, while borrowers pay full interest rates.

Based on the utilization rate-driven interest rate curve, although higher interest rates can be pushed up during rising risk, when lending demand is low, idle funds cannot be activated. Funds just sit inefficiently in the pool. Just these three markets cause an annual value loss of about $52 million due to idle capital—almost a quarter of Aave's first-quarter annualized revenue—entirely due to the inefficiency of the interest spread. Even if reserve ratios are set to zero and platform fees are eliminated, the idle fund problem persists, revealing an inherent flaw in the shared liquidity pool architecture.

Morpho's target utilization rate is 90%, much higher than Aave's 60–80%. The platform maintains high utilization because funds deposited into Morpho cannot be reused as collateral, effectively avoiding chain reactions of liquidations. This risk forces the shared pool to hold large buffers of funds as risk reserves. When lending scales up, interest rates automatically rise to attract more deposits; when demand drops, rates fall to stimulate borrowing. The entire system can sustain a dynamic balance without governance votes.

The advantages are now evident: Morpho's leading USDC liquidity pool, after deducting risk control fees, still offers depositors higher yields than Aave and Compound. Morpho's loan-to-deposit ratio is 41%, compared to Aave's 39%. This difference, applied to billions of dollars in deposits, means all depositors' yields compound daily.

Who is the preferred institution?

Perhaps surprisingly, all of Coinbase's crypto asset-backed lending business relies on Morpho. The current loan scale exceeds $2 billion, and over 100 million users can directly earn yields based on Morpho.

Most users are unaware they are using decentralized finance services. Coinbase did not develop its own lending system nor choose other lending platforms; the core reason is that Morpho's underlying architecture allows it to set risk parameters independently, select risk control partners, and fully control the entire product experience.

Apollo Global Management, with over a trillion dollars in assets under management and three decades of experience in private credit, recently signed a four-year cooperation agreement to acquire up to 90 million MORPHO tokens, about 9% of the total supply. The firm will pledge its tokenized fund assets as collateral into Morpho, with Gauntlet managing the liquidity pools and conducting stress tests on various market strategies.

Moreover, the United States' first federally licensed native crypto bank, Anchorage Digital, has integrated Morpho for its institutional clients managing hundreds of billions of assets. France's Societe Generale subsidiary SG-FORGE has also become the first fully compliant licensed bank to deploy decentralized lending via Morpho.

These regulated financial institutions choose Morpho because its independent market model helps them meet compliance requirements autonomously, without relying on DAO decision-making.

All these institutions want a lending infrastructure that allows them to set risk parameters independently and hire dedicated risk control teams. In contrast, Aave's model involves DAO-centered decision-making for all markets, preventing institutions from autonomous control. With Morpho, partners can fully manage the entire business system.

Regulatory environments further amplify this trend. The U.S. "GENIUS Act" stipulates that stablecoin issuers cannot directly pay yields to users, requiring neutral underlying infrastructure that allows assets to generate ongoing returns. U.S. officials project that by 2028, stablecoin reserves invested in U.S. Treasuries will grow from the current $1.2 trillion to over $10 trillion.

This massive capital needs corresponding lending layers, enabling asset allocators to independently manage risk. Currently, Morpho appears to be the most suitable solution for this need.