Aave Whale's "Midnight Liquidity Grab" Drains $6 Million from Borrowers Every Night—Who Exactly Is Behind This?

Author: Cooper Duschang

Translation: TechFlow

TechFlow Editor's Note: Someone withdraws $190 million in liquidity from Aave's USDC pool every night and returns it half an hour later—this operation costs all borrowers an extra $6 million in interest annually. TechFlow tracked on-chain fund flows and found this is likely a mandatory process for a fund to prove to investors daily that "I indeed hold these funds." DeFi's transparency exposes the hidden tax of traditional financial compliance processes on on-chain users.

Key Findings

Since May, the utilization rate of Aave's USDC pool has spiked daily during the midnight UTC period. The reason is that someone withdraws $190 million USDC around 23:30 and deposits it back within an hour. This affects the interest rates for all lenders and borrowers in the pool.

Tracking the fund flows of this wallet, we found the most plausible explanation for this behavior is: an institution needs to withdraw funds from the DeFi pool daily, take a snapshot to prove asset ownership, and then deposit them back.

This "withdrawal-deposit" time window became increasingly tight in July, concentrated around midnight UTC. Compared to a scenario without liquidity withdrawal, this operation costs all USDC borrowers an extra $6 million annually.

How Does Aave's Utilization Mechanism Work?

Aave's dual interest rate model incentivizes borrowing based on a target utilization rate. Interest rates rise slowly when utilization is below the target and increase sharply when exceeding the target. The utilization formula is (Total Borrowed / Total Deposited). For example, the more assets borrowed, the closer utilization gets to 100%.

Figure: Aave Dual Interest Rate Model—Borrow interest rate curve spikes after utilization exceeds the target value (e.g., 92%). Source: Coin Metrics / Talos

The target utilization rate for the USDC market on Aave's Ethereum main instance is 92%. After exceeding the target, the interest rate curve becomes very steep—from 92% to 100% utilization, the borrow interest rate surges from 4% to 14%. This suppresses borrowing demand, or rather, encourages more people to deposit USDC to meet demand.

The utilization rate of the Aave USDC market usually fluctuates around 90%. However, since May, looking at minute-level data, utilization has shown repeated spikes.

Figure: Minute-level data of Aave USDC market utilization, showing regular midnight spikes since May. Source: Coin Metrics / Talos

Why Do These Spikes Occur?

Excluding governance adjustments or oracle manipulation, there are only two variables affecting utilization: USDC deposit amount and borrowing amount.

Except for one brief decline in borrowing, total borrowings have averaged $1.89 billion since June 27. If borrowing did not continue to surge—which would push up utilization—then the USDC deposit amount must be plummeting.

Between 23:30 UTC and no later than 00:30 UTC, over $150 million USDC deposits were withdrawn and deposited back. Available liquidity plummeted from approximately $210 million to a low of just $33,000.

Figure: Daily between 23:30–00:30 UTC, over $150 million USDC is withdrawn and deposited back, available liquidity plummets from approx. $210 million to a low of $33,000. Source: Coin Metrics / Talos

Who Is Creating These Spikes?

Ethereum's pseudonymity allows us to publicly track addresses and transactions without exposing users or intent. We found the address transferring $190 million every night: 0x56957E411Ea83a0B4A0689C1fB0D1e5eA0d20149.

Figure: Fund flow path of the involved address 0x5695…0149, withdrawing liquidity from Aave for a snapshot every night and returning it. Source: Coin Metrics / Talos

This account received funds on December 5, 2025. Checking balance changes and fund flows, we tracked that this target address performed similar operations on Aave's PYUSD pool in December and January. The target address receives USDC, deposits it into the Aave pool, withdraws around 23:30 UTC, and sends it to 0x31173Ed183e5a9450C3671018ec4d770c8A8bF18 a few minutes later. The USDC is then returned shortly after 00:00 UTC and deposited back into the Aave pool.

This "coordinator wallet" 31173e…bf18 receives funds from the target address and another address that earns yield by holding sUSDS via depositing USDC. The combination of these funds is sent to a third upper-layer wallet 0xf1edbf98dda764ec51de3776371f0f7d6f6156a8 every night.

This is likely a process where an investor is required to prove their holdings daily, withdrawing liquidity from the DeFi pool to take a snapshot.

From June to July, the average time window for withdrawal and redeposit tightened. Withdrawal time shifted from 23:20 to 23:34, and redeposit time shortened from 00:34 to 00:09. In June, the average interval between withdrawal and redeposit was 259 blocks, shortening to 177 blocks in July.

Figure: Withdrawal and redeposit time window tightened from June to July, interval shortened from an average of 259 blocks to 177 blocks. Source: Coin Metrics / Talos

What Impact Does This Have on Borrowers?

The utilization spike caused by liquidity withdrawal benefits depositors but harms borrowers. When utilization spikes, the variable borrow interest rate also surges, leading to temporarily higher repayment amounts calculated per block.

Yields or interest on Aave are paid streamingly per block. Ethereum's average block time is 12 seconds, producing approximately 5 blocks per minute. We broke down the variable borrow APR and simulated how a $1 million borrow position is affected by minute-by-minute borrow interest rate changes.

Figure: Minute-by-minute borrow interest rate changes for a $1 million borrow position when liquidity is withdrawn, paying approx. $9 extra per night over 18 days. Source: Coin Metrics / Talos

Over 18 days, when liquidity was withdrawn, borrowers with a $1 million borrow position paid an average of $9 extra per day compared to a simulated scenario where liquidity was not temporarily altered. This amounts to a loss of approximately $3,280 annually. For the total $1.89 billion in borrowings in the USDC pool, this costs all borrowers an extra $17,000 per night, totaling $6 million annually. Borrowers are paying extra due to activities unrelated to their own loans.

Why Is This Important?

We believe these consistent utilization spikes best fit the explanation of a fund proving its holdings. Establishing regulations around DeFi investments and improving workflows can help reduce these negative impacts on lending pools. Blockchain transparency helps track fund flows within blockchain protocols without needing to send them to designated addresses to prove funds exist and are under approved control.

Nowadays, lenders and borrowers must not only monitor the health of their own positions but also monitor positions across the entire pool. Tracking funds and deciphering their intent can help assess new risks and predict liquidity and interest rate changes.