Every night at midnight UTC, a mystery whale walks up to DeFi’s liquidity window and takes 290 million USD off the table. Half an hour later, the money comes back. According to blockchain analytics firm Bitquery, this has happened for 394 consecutive nights — and it is quietly tripling borrowing costs for everyone else on Aave.
One whale, 394 nights, 290 million USD
Bitquery reported on Oct. 28 that an unidentified wallet cluster has been executing recurring USDC withdrawals around midnight UTC, pulling approximately 134 million USD out of Aave and the remainder out of Sky — roughly 290 million USD in total per cycle. The funds typically return about thirty minutes later. The pattern has repeated nightly since Sept. 30, 2025, with the earliest identified midnight transfers dating back to July 2024.
The scale of the nightly raid is striking. On the night of Oct. 26-27, Aave held approximately 173 million USD in immediately available USDC liquidity. The unidentified holder withdrew 134.1 million USD — about 78 percent of the pool’s spare cash — in one move. That left every other depositor on the platform sharing less than 46 million USD in withdrawable USDC until the whale returned the funds.
Utilization at 100 percent and rates that tripled
The mechanics of what happens next are pure DeFi supply and demand. During October, the withdrawals pushed Aave’s median USDC utilization rate from 94 percent to 99.6 percent — meaning almost every deposited dollar was borrowed out and almost nothing remained as a liquidity buffer. On six separate nights, utilization hit 100 percent, leaving virtually no unborrowed USDC for depositors trying to exit their positions.
Aave’s interest-rate model responds automatically to scarcity. Bitquery found that median annualized USDC borrowing rates rose from 4.5 percent before the withdrawals to 13.8 percent afterward, falling back once the funds returned. Aavescan data showed the pool’s borrowing rate at 13.27 percent at midnight UTC on Oct. 28, easing to 5.45 percent by Oct. 29 as the latest squeeze proved less severe.
For borrowers, the damage was real but bounded — the elevated rates lasted only as long as each liquidity shortage, roughly half an hour per night. For lenders, the risk was different: if you happened to withdraw during the squeeze window, your money was simply not there.
The rewards-farming theory
Why would anyone run this expensive ritual nightly? The leading theory is reward arbitrage. The withdrawn USDC is repeatedly consolidated into a single wallet across midnight, a structure that would benefit if a stablecoin rewards program calculated payouts using daily balance snapshots — the wallet would collect rewards as if the funds were parked, while the tokens were actually out of the lending pool earning nothing for anyone else.
The catch is that Coinbase, which operates USDC’s reward program, does not publicly disclose when it calculates rewards. Bitquery could not determine whether the wallet actually received any additional payments, leaving the motivation formally unresolved. It could be a sophisticated rewards play, a treasury rebalancing routine by an institution with poor automation hygiene, or a deliberate stress test of DeFi liquidity. Nobody knows — and that uncertainty is itself the story.
Why this matters for everyday DeFi users
This episode is a live demonstration of concentration risk that most yield farmers never price in. Aave is the largest lending protocol in DeFi, audited endlessly and governed by one of the most mature DAOs in the industry — and yet a single anonymous actor can, on any given night, make it temporarily impossible for ordinary depositors to access their own USDC. No hack occurred. No oracle failed. No contract was exploited. The system worked exactly as designed, and the design leaves room for one wallet to crowd everyone else out at the worst possible moment.
The practical takeaways are straightforward. First, if you lend stablecoins on Aave, understand that your “instant” withdrawal is only as instant as the unused liquidity in the pool — check utilization before assuming you can exit at midnight. Second, elevated borrowing rates at odd hours are not always organic demand; they can be one whale’s nightly routine. Third, this is precisely the kind of behavior that protocol-level caps, dynamic fees, or liquidity-buffer mechanisms may be forced to address if the pattern continues.
What comes next
Bitquery has not identified the wallet owner and has not established whether the recurring transfers will continue. The rate relief on Oct. 29 suggests the pattern may be easing — or simply that the whale shifted timing. Aave’s governance forums have not yet announced a formal response, but a 394-night streak that maxes out utilization six times in a month is exactly the kind of persistent stress that eventually ends up in a temperature-check proposal.
Until then, every midnight UTC, DeFi’s largest lending market holds its breath. One anonymous wallet pulls the liquidity, rates spike, depositors get squeezed, the money returns, and the cycle resets. It is not a hack, not an exploit, and not a failure — it is something stranger: a half-billion-dollar question mark running on a schedule, and a reminder that in DeFi, your counterparty risk is not always who you think it is.
394 nights in a row and nobody at aave thought to cap a single wallet withdrawal share? 78 percent of spare USDC gone in one tx
borrowing at 13.8 percent for half an hour a night so one wallet can farm rewards. regular users are paying for whale yield, great design
honestly the wilder part is it always comes back. if one night they decide not to return it, that pool is gone
classic rate farming. spike utilization, harvest the elevated borrow rewards, repay before the pool adjusts. been done on smaller protocols for years