Every night, $190 million in liquidity is withdrawn: Aave borrowers pay an annual $6 million “midnight tax.”

Coin Metrics found that a single whale withdraws $190 million in liquidity from the Aave USDC pool every night and then deposits it back, causing all borrowers to pay an additional $6 million in interest per year. On-chain fund flow tracking suggests this is likely a “forced process” created by a fund to meet regulatory snapshot requirements.
(Background: OpenAI completes a $6.6 billion equity private placement, valuation skyrockets to $500B! Taking on a head-on fight with Musk’s xAI)
(Background update: A Robinhood CEO account was stolen! The meme coin VLAD stole 650 ETH)

Table of contents

Toggle

• Core data: $190 million liquidity pulled out every night
• Interest-rate curve trap: when utilization exceeds 92%, borrowing costs surge
• Midnight spike decrypted: $150 million in deposits temporarily evaporates
• On-chain fund flow tracking: from wallet addresses to a fund compliance process
• Borrower cost: $9 more per night for a $1 million position
• Implications for compliance tax: how DeFi transparency becomes a double-edged sword

DeFi transparency is often seen as an advantage, but Coin Metrics’ latest investigation reveals that this feature also passes the compliance costs of traditional finance onto on-chain borrowers in the form of an “invisible tax.” Since this May, during the midnight UTC window, the USDC funding pool on Aave has shown recurring liquidity withdrawals—around 23:30, a whale pulls about $190 million in USDC, deposits it back within half an hour, and that causes all borrowers to pay an additional $6 million in interest per year. After tracking the on-chain fund flows, Coin Metrics believes this is very likely a mandatory process in which a fund, every day, proves to investors that it holds the assets.

DeFi transparency exposes the “invisible tax” that traditional finance compliance processes impose on on-chain users.

Since May, utilization of Aave’s USDC pool during the midnight UTC window has been spiking every day. The reason is that someone withdraws $190 million in USDC around 23:30 and then deposits it back within an hour. This affects the interest rates for all lenders and borrowers in the pool.

After tracking the flow of funds from this wallet, we found that the most likely explanation for this behavior is: an institution needs to pull funds out of the DeFi pool each day to perform snapshot proofs of asset ownership, and then return the funds afterward.

Core data: $190 million liquidity pulled out every night

The timing window for this “withdrawal-back deposit” has tightened further in July, clustering around midnight UTC. Compared with scenarios without withdrawals, this operation makes all USDC borrowers pay an additional $6 million per year.

Aave’s dual interest rate model incentivizes borrowing based on the target utilization rate. When utilization is below the target, interest rates rise slowly; when utilization exceeds the target, interest rates jump sharply. The utilization calculation formula is (total borrows / total deposits). For example, the more assets that are borrowed, the closer utilization gets to 100%.

Chart: Aave dual interest rate model—after utilization exceeds the target (e.g., 92%), the borrowing interest rate curve steeply rises. Source: Coin Metrics / Talos

On the Ethereum mainnet example for Aave, the USDC market’s target utilization rate is 92%. Once above the target, the interest rate curve becomes very steep—from 92% to 100% utilization, the borrowing rate jumps from 4% to 14%. This suppresses borrowing demand, or in other words, encourages more people to deposit USDC to meet demand.

Interest-rate curve trap: borrowing costs surge when utilization exceeds 92%

Utilization in the Aave USDC market typically fluctuates around 90%. But starting in May, if you look at minute-level data, utilization shows repeated peaks.

Chart: Aave USDC market utilization, minute-level data—since May, regular midnight peaks appear. Source: Coin Metrics / Talos

Excluding governance adjustments or oracle manipulation, there are only two variables that affect utilization: the amount of USDC deposited and the amount borrowed.

Aside from one brief drop in borrowing, since June 27 total borrows have averaged $1.89 billion. If borrowing were not continuously spiking—which would increase utilization—then USDC deposit volume must have been crashing.

Midnight spike decrypted: $150 million in deposits temporarily evaporates

Between 11:30 UTC and as late as 00:30 UTC, more than $150 million in USDC deposits were withdrawn and then returned. Borrowable liquidity fell from about $210 million to a minimum of just $33k.

Chart: Over 11:30–00:30 UTC each day, more than $150 million in USDC is withdrawn and returned; borrowable liquidity plunges from about $210 million to a minimum of $33k. Source: Coin Metrics / Talos

Ethereum’s pseudonymity lets us publicly track addresses and transactions, but it does not reveal users or intent. We found the address that transfers $190 million every night: 0x56957E411Ea83a0B4A0689C1fB0D1e5eA0d20149.

Chart: Funds flow path involving the address 0x5695…0149—after extracting liquidity from Aave for the snapshot, it is returned every night. Source: Coin Metrics / Talos

On-chain fund flow tracking: from wallet addresses to the fund compliance process

This account received funds on December 5, 2025. By examining balance changes and fund flows, we traced that this target address performed similar operations on Aave’s PYUSD pool in December and January. The target address received USDC, deposited it into the Aave pool, withdrew at around 23:30 UTC, and sent it to 0x31173Ed183e5a9450C3671018ec4d770c8A8bF18 a few minutes later. The USDC was then returned shortly after 00:00 UTC and deposited back into the Aave pool.

This “coordinating wallet” 31173e…bf18 received payments from the target address and from another address that holds sUSDS to earn yield. Each night, the combination of these funds was sent to a third-level upper wallet: 0xf1edbf98dda764ec51de3776371f0f7d6f6156a8.

This is very likely the process by which an investor is required to prove its holdings every day—by withdrawing liquidity from the DeFi pool to take snapshots.

From June to July, the average timing window for withdrawal-and-return tightened. The withdrawal time moved from 23:20 to 23:34, and the return time shrank from 00:34 to 00:09. The average interval between withdrawal and return was 259 blocks in June and shortened to 177 blocks in July.

Borrower cost: $9 more per night for a $1 million position

While spikes in utilization due to liquidity being withdrawn benefit depositors, they harm borrowers. When utilization spikes, the floating borrowing interest rate also spikes, leading to higher interim repayment amounts calculated per block.

On Aave, earnings or interest are paid in a streaming manner per block. Ethereum’s average block time is 12 seconds, generating about 5 blocks per minute. We broke down the floating borrowing annualized interest rate and simulated how a $1 million borrowing position would be affected by minute-by-minute borrowing rate changes.

Chart: A $1 million borrowing position—minute-by-minute borrowing rate changes when liquidity is withdrawn; about $9 extra per night over 18 days. Source: Coin Metrics / Talos

Implications for compliance tax: how DeFi transparency becomes a double-edged sword

Over 18 days, when liquidity is withdrawn, borrowers of a $1 million position pay an average of $9 more per day than in a simulation where the liquidity is not temporarily changed. This means an annual loss of about $3,280. For total borrows of $1.89 billion in the USDC pool, this results in all borrowers paying an additional $17k per night, or $6 million per year. Borrowers end up paying extra money for activities unrelated to their own lending.

We believe these consistent utilization spikes most closely match the explanation that a fund proves its holdings. Building regulations around DeFi investments and improving workflow processes can help reduce these negative impacts on lending pools. Blockchain transparency helps track the flow of funds within blockchain protocols without having to send to specific addresses to prove the funds exist and are under the control of the approving party.

Today, lenders and borrowers need to monitor not only the health of their own positions, but also the positions across the entire pool. Tracking funds and deciphering their intent can help assess new risks and predict changes in liquidity and interest rates.