On November 3, Balancer suffered the most severe attack in its history, with $116 million stolen.
Just 10 hours later, another seemingly unrelated protocol, Stream Finance, began to experience abnormal withdrawals. Within 24 hours, its issued stablecoin xUSD started to depeg, plummeting from $1 to $0.27.
If you think these are just two independent protocols each having bad luck, you’d be wrong.
According to on-chain data, about $285 million inDeFi loans use xUSD/xBTC/xETH as collateral. From Euler to Morpho, from Silo to Gearbox, almost all mainstream lending platforms have exposure.
Even worse, 65% of Elixir’s deUSD stablecoin reserves ($68 million) are exposed to Stream’s risk.
This means that if you have deposits on any of the above platforms, hold related stablecoins, or provide liquidity, your funds may be experiencing a crisis you’re not yet aware of.
Why did the hack of Balancer trigger a butterfly effect, causing problems for Stream? Are your assets at risk?
We attempt to quickly clarify the negative events of the past two days and identify possible asset risks involved.
The Balancer Butterfly Effect: xUSD Depegs Due to Panic
To understand the depegging of xUSD and the assets potentially affected, we first need to clarify how two seemingly unrelated protocols became fatally linked.
First, after the veteran DeFi protocol Balancer was hacked yesterday, the hacker made off with over $100 million. Since Balancer held various assets, the news caused panic throughout the DeFi market.
(Related reading: 5 Years, 6 Incidents, Over $100 Million Lost: The History of Hacks at Veteran DeFi Protocol Balancer)
Although Stream Finance had no direct relationship with Balancer, its depegging stemmed from the spread of panic and a bank run.
If you’re unfamiliar with Stream, you can simply think of it as a DeFi protocol seeking high yields; and the way it seeks high yields is through “looping leverage”:
Simply put, it repeatedly uses users’ deposits as collateral and borrows against them to amplify investment size.
For example, if you deposit $1 million, Stream will use that $1 million as collateral on Platform A to borrow $800,000, then use the $800,000 as collateral on Platform B to borrow $640,000, and so on. In the end, your $1 million could be amplified to an investment size of $3 million.
According to Stream’s own data, they amplified $160 million in user deposits to $520 million in deployed assets using this method. This more than 3x leverage can generate attractive high yields in stable markets, which attracted many yield-seeking users to Stream.
But high yields come with high risks. When news of the Balancer hack spread, DeFi users’ first reaction was: “Is my money still safe?”
A large number of users began withdrawing from various protocols. Stream’s users were no exception; the problem is, Stream’s money might not actually be in its own hands.
Through looping leverage, funds are nested layer upon layer in various lending protocols.
To meet users’ withdrawal requests, Stream needs to unwind these positions layer by layer, such as repaying loans on Platform C to retrieve collateral, then repaying Platform B, then Platform A. This process is not only time-consuming, but in times of market panic, it may also face liquidity exhaustion.
Even worse, at the critical moment when users were frantically withdrawing, Stream Finance posted a shocking statement on Twitter: an “external fund manager” managing Stream’s funds reported that about $93 million in assets were missing.
Users were already panic-withdrawing, and now nearly $100 million in missing funds was revealed.
Stream stated in its announcement that it had hired top law firm Perkins Coie to investigate. The announcement appeared very official, but there was no mention of how the money went missing or when it might be recovered.
Such vague explanations do not satisfy the market, which will not wait for the investigation results. When users notice withdrawal delays, a bank run ensues.
xUSD, as the “stablecoin” issued by Stream, was supposed to be pegged to $1. But when everyone realized Stream might not be able to honor its commitments, a selling wave ensued. From late night on November 3 to today, xUSD has dropped to around $0.27, a severe depeg.
Therefore, xUSD’s depegging is not a technical failure, but a collapse of confidence. The downturn in the crypto market and the Balancer hack were merely triggers; the real bomb may be Stream’s own high-leverage model, or even a common problem among similar DeFi protocols.
The Asset Checklist You Need to Review
The collapse of xUSD is not an isolated incident.
According to on-chain analysis by Twitter user YAM, there are currently about $285 million in loans collateralized by Stream-issued xUSD, xBTC, and xETH. This means that if these stablecoins and collateral assets go to zero, the entire DeFi ecosystem will feel the shockwaves.
If you don’t understand the mechanism, consider the following analogy:
Stream issues three types of “IOUs” using your deposited USDC and other stablecoins:
-
xUSD: Equivalent to an IOU for dollars
-
xBTC: Equivalent to an IOU for bitcoin
-
xETH: Equivalent to an IOU for ethereum
Under normal circumstances, for example, you take xUSD (the dollar IOU) to Euler and say: this IOU is worth $1 million, I’ll use it as collateral to borrow $500,000.
But after xUSD depegs:
xUSD drops from $1 to $0.3, so your “$1 million” collateral is actually only worth $300,000; but since you can borrow $500,000, that means Euler loses $200,000.
In simple terms, this is more like a bad debt, and ultimately protocols like Euler and other DeFi platforms will have to fill the hole. The problem is, most of these lending protocols are likely unprepared for bad debts of this scale.
Even worse, many platforms use “hard-coded” price oracles, which determine collateral value based on “book value” rather than real-time market prices.
This can prevent unnecessary liquidations during normal short-term volatility, but now it’s become a ticking time bomb.
Even if xUSD has dropped to $0.3, the system may still consider it worth $1, making it impossible to control risk in time.
According to YAM’s analysis, the $285 million in debt is distributed across multiple platforms and managed by different “Curators” (fund managers). Let’s see which platforms are sitting on this powder keg:
-
Biggest Victim: TelosC - $123.6 million
TelosC is the largest fund manager, managing two main markets on Euler:
-
Ethereum mainnet: lent out $29.85 million worth of ETH, USDC, and BTC
-
Plasma chain: lent out $90 million USDT, plus nearly $4 million in other stablecoins
This $120 million accounts for almost half of the total exposure. If xUSD goes to zero, TelosC and its investors will suffer huge losses.
If you have deposits in these Euler markets, you may already be unable to withdraw normally. Even if Stream eventually recovers some funds, liquidation and bad debt resolution will take a long time.
-
Indirect Blowup: Elixir’s deUSD, $68 million
Elixir lent $68 million USDC to Stream, which accounts for 65% of deUSD stablecoin reserves. Although Elixir claims to have “1:1 redemption rights” and is the only creditor with such rights, the Stream team previously responded that they cannot pay out until lawyers determine who is entitled to what.
This means that if you hold deUSD, two-thirds of your stablecoin’s value depends on whether Stream can repay. As it stands, both “whether” and “when” are unknowns.
-
Other Scattered Risk Points
On Stream, “Curators” are professional institutions or individuals responsible for managing liquidity pools. They decide which collateral to accept, set risk parameters, and allocate funds.
Simply put, they are like fund managers, lending out other people’s money to earn returns. Now, these “fund managers” are all trapped by Stream’s collapse:
-
MEV Capital - $25.42 million: An investment firm focused on MEV (Maximum Extractable Value) strategies. They have positions on multiple chains:
For example, in the Sonic chain’s Euler market, they deposited $9.87 million xUSD and 500 xETH; on Avalanche, they have $17.6 million xBTC exposure (272 BTC lent out).
-
Varlamore - $19.17 million: They are the main liquidity provider on Silo Finance, with exposure distributed as follows:
$14.2 million USDC on Arbitrum, accounting for almost 95% of that market;
About $5 million more on Avalanche and Sonic. Varlamore manages institutional and large account funds, and this incident may lead to large-scale redemptions.
-
Re7 Labs - $14.26 million: Re7 Labs set up a dedicated xUSD market on Plasma chain’s Euler, all $14.26 million in USDT.
Other smaller players potentially affected include:
-
Mithras: $2.3 million, focused on stablecoin arbitrage
-
Enclabs: $2.56 million, across both Sonic and Plasma chains
-
TiD: $380,000, a small amount but possibly their entire capital
-
Invariant Group: $72,000
These Curators certainly weren’t gambling with deposited funds and must have assessed the risks. But when an upstream protocol like Stream has problems, all downstream risk controls become passive.
Bear Market: A Crypto Version of the Subprime Crisis?
If you’ve seen the movie “The Big Short,” what’s happening now may feel familiar.
In 2008, Wall Street packaged subprime loans into CDOs, then repackaged them into CDO², and rating agencies gave them AAA labels. Today, Stream amplifies user deposits 3x through looping leverage, and xUSD is accepted as “high-quality collateral” by major lending platforms. History doesn’t repeat, but it certainly rhymes.
Stream previously claimed to have $160 million in deposits, but in reality, this amount was ultimately deployed as $520 million in assets. How did this number come about?
DefiLlama has long questioned this calculation method: looping leverage essentially double-counts the same money, which is a manifestation of inflated TVL.
The contagion path of the subprime crisis was: mortgage defaults → CDO collapse → investment banks fail → global financial crisis.
This time, the path is: Balancer hacked → Stream bank run → xUSD depegs → $285 million in loans become bad debt → more protocols may fail.
When using DeFi protocols for high-yield farming, people rarely ask how the money is made or where the profits come from when the market is good; but once a negative event occurs, it’s often the principal that’s lost.
You may never truly know your real risk exposure in DeFi protocols. In a DeFi world without regulation, insurance, or a lender of last resort, your fund safety is ultimately up to you to protect.
The market is not doing well. Wishing you peace.
