The aftershocks of the Balancer hack are still ongoing. How will the depeg of Stream's xUSD affect your assets?

On November 3rd, Balancer suffered the most serious attack in its history, with $116 million stolen.

Just 10 hours later, another seemingly unrelated protocol, Stream Finance, began to experience withdrawal anomalies. Within 24 hours, its issued stablecoin xUSD started to decouple, plummeting from 1 dollar to 0.27 dollars.

If you think this is just a story of two independent protocols each having their own misfortune, then you are mistaken.

According to on-chain data, approximately $285 million in DeFi loans use xUSD/xBTC/xETH as collateral. From Euler to Morpho, from Silo to Gearbox, almost all mainstream lending platforms have exposure.

Worse still, Elixir's deUSD stablecoin has 65% of its reserves ($68 million) exposed to the risks of Stream.

This means that if you have deposits on any of the above platforms, hold relevant stablecoins, or have provided liquidity, your funds may be undergoing a crisis that you are not yet aware of.

Why does the hacking of Balancer create a butterfly effect, causing issues for Stream? Are your assets at risk?

We are trying to help you quickly clarify the negative events of the past two days and identify any potential asset risks that may exist.

Balancer Butterfly Effect, xUSD decouples due to panic

To understand the decoupling of xUSD and the assets that may be affected, we first need to clarify how two seemingly unrelated protocols have created a fatal connection.

First, the well-established DeFi protocol Balancer was hacked yesterday, with the hacker stealing over $100 million. Due to the variety of assets in Balancer, the news has sent the entire DeFi market into a panic.

(Related reading: 5 years, 6 accidents resulting in losses exceeding 100 million, the history of hacker visits to the established DeFi protocol Balancer)

Stream Finance, although not directly related to Balancer, is decoupled due to the spread of panic sentiment and runs on the bank.

If you are not familiar with Stream, you can simply understand it as a DeFi protocol that seeks high returns; and its method of seeking high returns is through “circular nesting”:.

In simple terms, it means repeatedly mortgaging and lending users' deposits to amplify the investment scale.

For example, if you deposit 1 million, Stream will use this 1 million to mortgage and lend 800,000 on platform A, and then take 800,000 to mortgage and lend 640,000 on platform B, and so on. Ultimately, your 1 million could be leveraged to an investment scale of 3 million.

According to Stream's own data, they leveraged $160 million of user deposits to amplify it to $520 million in deployed assets. This more than 3x leverage can generate enticing high returns when the market is stable, which has attracted a large number of yield-seeking users to Stream.

But behind high returns is high risk. When news of Balancer being hacked spread, the first reaction of DeFi users was: “Is my money still safe?”

A large number of users are starting to withdraw from various protocols. Stream users are no exception; the problem is that Stream's funds may not be in its own hands.

Through a loop of nested dolls, funds are layered and embedded in various lending protocols.

To meet the user's withdrawal requests, Stream needs to gradually unwind these positions, such as first repaying the loan on platform C, retrieving the collateral, then repaying platform B, and finally platform A. This process is not only time-consuming but may also face liquidity exhaustion during market panic.

What's worse is that at the crucial moment when users were frantically withdrawing funds, Stream Finance posted a shocking statement on Twitter: an “external fund manager” managing Stream's funds reported that approximately $93 million in assets had disappeared.

Users were already in a state of panic withdrawal, and now a funding gap of nearly 100 million dollars has surfaced.

Stream stated in a declaration that it has hired the top law firm Perkins Coie for an investigation. This announcement seems very official, but it does not mention how the money went missing or when it can be recovered.

This vague explanation will not make the market wait for the investigation results. When users discover withdrawal delays, a run on the bank will occur.

xUSD, issued by Stream as a “stablecoin”, was supposed to be pegged to 1 USD. However, when people realized that Stream might not be able to fulfill its promises, a wave of sell-offs ensued. From late night on November 3 to today, xUSD has already dropped to around 0.27, severely decoupling.

Therefore, the decoupling of xUSD is not a technical failure but a collapse of confidence. The downward trend in the crypto market and the hack of Balancer are merely the fuse; the real bomb may be the high leverage model of Stream itself, or even common issues among similar DeFi protocols.

Asset checklist you need to check

The collapse of xUSD is not an isolated event.

According to on-chain analysis by Twitter user YAM, there are currently about 285 million USD in loans collateralized by xUSD, xBTC, and xETH issued by Stream. This means that if these stablecoins and collateral assets go to zero, the entire DeFi ecosystem will feel the shockwaves.

If you don't understand the principle, you might as well take a look at the analogy below:

Stream issued three types of “IOUs” through your deposited USDC and other stablecoins:

xUSD: A certificate equivalent to “I owe you dollars”.

xBTC: A certificate equivalent to “I owe you Bitcoin”

xETH: A certificate equivalent to “I owe you Ethereum”

Under normal circumstances, for example, if you take xUSD (a dollar IOU) to the Euler platform and say: this IOU is worth 1 million dollars, I collateralize it to you and borrow 500,000.

But when xUSD is unpegged:

xUSD fell from 1 dollar to 0.3 dollars, which means your collateral of “1 million” is actually only worth 300,000; but since you can borrow 500,000, it means Euler is still at a loss of 200,000.

In simple terms, this is more like a bad debt that ultimately needs DeFi protocols like Eluler to fill the gap. But the problem is that most of these lending protocols may not be prepared for such a scale of bad debt.

Worse still, many platforms use “hard-coded” price oracles, which assess collateral value based on “book value” rather than real-time market prices.

This can usually avoid unnecessary liquidations caused by short-term fluctuations, but now it has become a ticking time bomb.

Even if xUSD has dropped to $0.3, the system may still consider it worth $1, leading to risks that cannot be controlled in a timely manner.

According to YAM's analysis, $285 million in debt is distributed across multiple platforms, managed by different “Curators” (fund managers). Let’s take a look at which specific platforms are sitting on this powder keg:

The biggest victim: TelosC - $123.6 million

TelosC is the largest fund manager, managing two main markets on Euler:

Ethereum Mainnet: $29.85 million worth of ETH, USDC, and BTC has been lent out.

Plasma chain: lent out 90 million USDT, plus nearly 4 million in other stablecoins

This $120 million accounts for nearly half of the total exposure. If xUSD goes to zero, TelosC and its investors will suffer huge losses.

If you have deposits in these markets of Euler, it may no longer be possible to withdraw normally. Even if Stream can eventually recover some funds, the liquidation and bad debt handling will take a long time.

Indirect explosion: Elixir's deUSD, 68 million USD

Elixir lent Stream $68 million USDC, which accounts for 65% of the deUSD stablecoin reserves. Although Elixir claims they have a “1:1 redemption right” and are the only creditor with this right, the Stream team previously responded that, in essence, we cannot make payments until the lawyers determine who is entitled to what.

This means that if you hold deUSD, two-thirds of the value of your stablecoin depends on whether Stream can repay. And now it seems that both the “whether” and “when” are unknowns.

Other scattered risk points

On Stream, a “Curator” is a professional entity or individual responsible for managing the fund pool. They decide which collateral to accept, set risk parameters, and allocate funds.

In simple terms, they are like fund managers, using other people's money to lend and earn profits. Now, these “fund managers” are all trapped by the collapse of Stream:

MEV Capital - 25.42 million USD: An investment institution focused on MEV (Maximum Extractable Value) strategies. They have a presence across multiple chains:

For example, the Euler market on the Sonic chain has deposited 9.87 million xUSD and 500 xETH; there is also a $17.6 million xBTC exposure on Avalanche (272 BTC have been borrowed).

Varlamore - $19.17 million: They are the main capital providers on Silo Finance, with exposure distributed in:

14.2 million USDC on Arbitrum accounts for nearly 95% of the market.

Avalanche and Sonic also manage about 5 million Varlamore for institutions and large holders, and this incident may lead to large-scale redemptions.

Re7 Labs - $14.26 million: Re7 Labs has opened a dedicated xUSD market on Euler of the Plasma chain, with the entire $14.26 million being in USDT.

Other potential small players who may be affected include:

Mithras: $2.3 million, focused on stablecoin arbitrage

Enclabs: 2.56 million USD, across the Sonic and Plasma chains.

TiD: $380,000, although the amount is small, it may be all of their funds.

Invariant Group: $72,000

These Curators are definitely not gambling with the deposited funds; they must have assessed the risks. However, when the upstream protocol Stream encounters issues, all downstream risk control measures will be very passive.

Is the market bearish, staging a crypto version of the subprime mortgage crisis?

If you have seen the movie “The Big Short,” what is happening now may feel familiar to you.

In 2008, Wall Street packaged subprime loans into CDOs, then repackaged them into CDO², and rating agencies labeled them with AAA. Today, Stream amplifies user deposits threefold through a recursive structure, and xUSD is accepted as “high-quality collateral” by major lending platforms. History does not repeat itself, but it certainly rhymes.

Stream previously claimed to have 160 million in deposits, but in reality, this level of deposits ultimately deployed into 520 million in assets. How did this figure come about?

DefiLlama has long questioned this calculation method, where cyclic lending creates a nesting effect, essentially leading to the repeated counting of the same amount of money, which is a manifestation of inflated TVL.

The contagion path of the subprime mortgage crisis is: mortgage defaults → CDO collapse → investment bank failures → global financial crisis.

The path this time is: Balancer hacked → Stream run on the bank → xUSD decoupled → 285 million loan becomes bad debt → more protocols may go bankrupt.

Using DeFi protocols for high-yield mining, when the market is good, people don’t really ask how money is made or where the profits come from; once a negative event occurs, the principal may be at risk.

You may never know the true risk exposure of the funds you have in DeFi protocols. In a DeFi world without regulation, insurance, or a lender of last resort, the safety of your funds can only be protected by yourself.

The market is not good, wishing you peace.