Aave Whale 'Midnight Siphoning' Costs Borrowers $6 Million Annually

Author: Cooper Duschang

Compiled by Deep潮 TechFlow

DeepFlow Summary: Someone withdraws $190 million in liquidity from Aave’s USDC pool every night and returns it half an hour later—a maneuver that costs all borrowers an additional $6 million in interest annually. DeepFlow’s on-chain tracking reveals this is likely a mandatory daily process used by a fund to prove to its investors that it truly holds these funds. DeFi’s transparency exposes the invisible tax imposed on on-chain users by traditional finance compliance procedures.

Since May, Aave’s USDC pool utilization has surged daily at midnight UTC. This is due to someone withdrawing approximately $190 million in USDC around 23:30 and redepositing it within an hour, affecting the interest rates for all lenders and borrowers in the pool.

By tracking the fund flows of this wallet, we found that the most plausible explanation is that an institution needs to withdraw funds daily from a DeFi pool, take a snapshot to prove asset ownership, and then redeposit them.

The window for this "withdrawal-redeposit" strategy became increasingly compressed in July, concentrated around midnight UTC. Compared to scenarios without liquidity withdrawal, this practice costs all USDC borrowers an additional $6 million per year.

Aave's dual interest rate model incentivizes borrowing and lending based on a target utilization rate. When utilization is below the target, interest rates rise slowly; when it exceeds the target, rates increase sharply. Utilization is calculated as (total borrowed / total deposited). For example, the more assets that are borrowed, the closer the utilization rate approaches 100%.

Chart: Aave’s Dual Interest Rate Model—Borrowing interest rates rise sharply after utilization exceeds the target (e.g., 92%). Source: Coin Metrics / Talos

The target utilization rate for the USDC market on the Aave Ethereum mainnet is 92%. Beyond this target, the interest rate curve becomes steep—borrowing rates rise from 4% to 14% as utilization increases from 92% to 100%. This discourages borrowing demand and encourages more users to deposit USDC to meet demand.

The utilization rate of the Aave USDC market typically fluctuates around 90%. However, since May, minute-by-minute data has shown repeated spikes in utilization.

Chart: Minute-by-minute utilization data for the Aave USDC market, showing regular midnight spikes since May. Source: Coin Metrics / Talos

Excluding governance adjustments or oracle manipulation, only two variables affect utilization: USDC deposits and borrowings.

Except for a brief dip in borrowing, total borrowing has averaged $1.89 billion since June 27. If borrowing hasn’t surged— which would increase utilization—then the decline must be in USDC deposits.

Between 11:30 UTC and as late as 00:30 UTC, over $150 million in USDC deposits were withdrawn and redeposited. Available liquidity plummeted from approximately $210 million to as low as $33,000.

Chart: Over $150 million in USDC was withdrawn and redeposited daily between 11:30–00:30 UTC, causing available liquidity to plummet from approximately $210 million to as low as $33,000. Source: Coin Metrics / Talos

Ethereum’s pseudonymity allows us to publicly trace addresses and transactions without exposing users or their intentions. We identified the address transferring $190 million nightly: 0x56957E411Ea83a0B4A0689C1fB0D1e5eA0d20149.

Chart: Fund flow path of the involved address 0x5695…0149, withdrawing liquidity from Aave snapshots each night and returning it. Source: Coin Metrics / Talos

This account received funds on December 5, 2025. Reviewing balance changes and fund flows, we traced similar activity by the target address on the Aave PYUSD pool during December and January. The target address received USDC, deposited it into the Aave pool, withdrew it around 23:30 UTC, and sent it to 0x31173Ed183e5a9450C3671018ec4d770c8A8bF18 shortly after. The USDC was then returned shortly after 00:00 UTC and redeposited into the Aave pool.

This "coordinating wallet" 31173e…bf18 receives funds from the target address and another address that holds sUSDS to earn yield via USDC deposits. These combined funds are sent nightly to a third upper-level wallet: 0xf1edbf98dda764ec51de3776371f0f7d6f6156a8.

This is likely a process where an investor is required to prove their holdings daily by withdrawing liquidity from a DeFi pool for a snapshot.

From June to July, the average time window for pumping and replenishing tightened. The pumping time shifted from 23:20 to 23:34, and the replenishment time was reduced from 00:34 to 00:09. The average interval between pumping and replenishment in June was 259 blocks, which shortened to 177 blocks in July.

Chart: The pump-and-dump time window narrowed from June to July, with the interval decreasing from an average of 259 blocks to 177 blocks. Source: Coin Metrics / Talos

The surge in utilization caused by liquidity being drained benefits depositors but harms borrowers. When utilization spikes, variable borrowing rates also rise, resulting in temporarily higher repayment amounts per block.

Yields or interest on Aave are paid out block by block. With Ethereum’s average block time of 12 seconds, approximately five blocks are produced per minute. We broke down the variable borrowing APR to simulate how a $1 million borrowing position is affected by minute-by-minute changes in the borrowing rate.

Chart: Hourly borrowing rate changes for a $1 million loan position when liquidity is withdrawn, resulting in an additional cost of approximately $9 per night over 18 days. Source: Coin Metrics / Talos

Over 18 days, borrowers with $1 million loan positions paid an average of $9 more per day when liquidity was withdrawn, compared to a scenario where liquidity remained unchanged. This amounts to an annual loss of approximately $3,280. For the total $1.89 billion in loans across the USDC pool, this results in borrowers collectively paying an extra $17,000 per night, or $6 million annually. Borrowers are paying more due to activities unrelated to their own loans.

We believe these consistent spikes in utilization are most consistent with a fund demonstrating its holdings. Establishing regulations and improving workflows around DeFi investments can help mitigate these negative impacts on lending pools. The transparency of blockchain enables tracking the flow of funds within blockchain protocols without requiring transfers to designated addresses to prove the existence and control of funds by approved parties.

Today, lenders and borrowers must not only monitor the health of their own positions but also track positions across the entire pool. Tracking funds and deciphering their intent can help assess new risks and predict changes in liquidity and interest rates.