On November 3, Balancer suffered its worst attack in history, with $116 million stolen.

Just 10 hours later, another seemingly unrelated protocol, Stream Finance, began experiencing abnormal withdrawals. Within 24 hours, its stablecoin, xUSD, began to decouple, plummeting from $1 to $0.27.

If you think this is just a story of two separate agreements going downhill, you're wrong.

According to on-chain data, approximately $285 million in DeFi loans use xUSD/xBTC/xETH as collateral . Almost all major lending platforms, from Euler to Morpho, from Silo to Gearbox, have this exposure.

Worse still, 65% of Elixir’s deUSD stablecoin reserves ($68 million) are exposed to Stream’s risk .

This means that if you have deposits, hold related stablecoins, or provide liquidity on any of the platforms mentioned above, your funds may be experiencing a crisis that you are unaware of.

Why did the Balancer hack have a butterfly effect, causing problems at Stream? Are your assets actually at risk?

We're trying to help you quickly sort out the negative events of the past two days and identify the potential asset risks involved.

Balancer's butterfly effect: xUSD decouples due to panic.

To understand the decoupling of xUSD and the assets that may be affected, we need to first understand how two seemingly unrelated protocols become fatally connected.

First, the well-established DeFi protocol Balancer was hacked yesterday, with hackers making off with over $100 million. Because Balancer contains various assets, the news has thrown the entire DeFi market into panic.

(Related reading: Balancer, a veteran DeFi protocol, suffers over 100 million RMB in losses from 6 incidents in 5 years )

Although Stream Finance is not directly related to Balancer, its decoupling stemmed from the spread of panic and a run on the bank.

If you're unfamiliar with Stream, you can simply understand it as a DeFi protocol that seeks high yields; and its method for finding high yields is a "recursive loop":

Simply put, it involves repeatedly mortgaging and borrowing users' deposits to amplify the scale of investment.

For example, if you deposit 1 million, Stream will use that 1 million as collateral to borrow 800,000 from platform A, then use that 800,000 as collateral to borrow 640,000 from platform B, and so on. Ultimately, your 1 million may be amplified to an investment scale of 3 million.

According to Stream's own data, they leveraged $160 million in user deposits to $520 million in deployed assets in this way. This leverage of more than 3 times can generate attractive high returns when the market is stable, which is why Stream has attracted a large number of users seeking higher returns.

But high returns come with high risks. When news of Balancer being hacked spread, DeFi users' first reaction was: "Is my money still safe?"

A large number of users began withdrawing funds from various protocols. Stream users were no exception; the problem was that their Stream funds might not actually be in their hands.

Through a nested loop, funds are layered within various lending agreements.

To fulfill users' withdrawal requests, Stream needs to unwind these positions layer by layer. For example, it might first repay the loan to platform C and retrieve the collateral, then repay platform B, and then platform A. This process is not only time-consuming, but it can also lead to liquidity shortages during market panics.

Even more critically, just as users were frantically withdrawing funds, Stream Finance released a shocking statement on Twitter: an “external fund manager” managing Stream’s funds reported that approximately $93 million in assets had disappeared.

Users were already making panic withdrawals, and now a funding gap of nearly $100 million has been revealed.

In its statement, Stream said it had hired top law firm Perkins Coie to investigate. The announcement seemed very official, but it made no mention of how the money was lost or when it could be recovered.

This vague explanation won't be accepted by the market until the investigation is complete. When users discover withdrawal delays, a bank run will occur.

xUSD, issued by Stream, was supposed to be pegged to $1. However, when people realized that Stream might not be able to deliver on its promises, a massive sell-off ensued. From late night on November 3rd to today, xUSD has fallen to around 0.27, severely decoupled from its peg.

Therefore, the decoupling of xUSD is not a technical glitch, but a collapse of confidence. The downward trend in the crypto market and the Balancer hack were just the triggers; the real bomb may be Stream's own high-leverage model, or even a common problem with similar DeFi protocols.

List of assets you need to check

The collapse of xUSD was not an isolated incident.

According to on-chain analysis by Twitter user YAM, approximately $285 million in loans are currently secured by xUSD, xBTC, and xETH issued by Stream. This means that if these stablecoins and collateralized assets were to go to zero, the entire DeFi ecosystem would feel the shockwaves.

If you don't understand the principle, you might want to look at the following analogy first:

Stream issues three types of "IOUs" based on your deposit of stablecoins such as USDC:

• xUSD : A certificate equivalent to "I owe you US dollars".
• xBTC : A certificate that signifies "I owe you Bitcoin".
• xETH : A certificate that signifies "I owe you Ethereum".

Normally, for example, you would take xUSD (US dollar IOU) to the Euler platform and say: This IOU is worth 1 million US dollars, I will use it as collateral to borrow 500,000.

But when xUSD became unpegged:

xUSD dropped from $1 to $0.3, meaning your "1 million" collateral was only worth $300,000; but because you could borrow $500,000, it meant Euler still lost $200,000.

In layman's terms, this is more like a bad debt, which ultimately needs to be filled by DeFi protocols like Eluler. The problem is that most of these lending protocols may not be prepared for bad debts of this scale.

Worse still, many platforms use "hard-coded" price oracles, which determine the value of collateral based on "book value" rather than real-time market prices.

This would normally prevent unnecessary liquidation caused by short-term fluctuations, but now it has become a time bomb.

Even if xUSD has fallen to $0.3, the system may still consider it to be worth $1, resulting in the risk not being controlled in time.

According to YAM's analysis, the $285 million in debt is spread across multiple platforms, managed by different "Curators" (fund managers). Let's take a look at which specific platforms are sitting on this powder keg:

Biggest victim: TelosC - $123.6 million

TelosC is the largest fund manager, managing two main markets on Euler:

• Ethereum mainnet: $29.85 million worth of ETH, USDC, and BTC lent out.
• Plasma Chain: lent out 90 million USDT, plus nearly 4 million in other stablecoins.

This $120 million represents almost half of the total exposure. If xUSD goes to zero, TelosC and its investors will suffer huge losses.

If you have deposits in these Euler markets, you may no longer be able to withdraw them normally. Even if Stream eventually recovers some funds, liquidation and bad debt processing will take a long time.

Indirect default: Elixir's deUSD, $68 million

Elixir lent Stream $68 million in USDC, representing 65% of the deUSD stablecoin reserve. While Elixir claims a "1:1 redemption right" and is the only creditor with this right, the Stream team previously responded in the sense that they could not pay until their lawyers determined who was entitled to what.

This means that if you hold deUSD, two-thirds of the value of your stablecoin depends on whether Stream can repay its debts. And currently, both "whether" and "when" are unknowns.

Other scattered risk points

On Stream, a "Curator" is a professional organization or individual responsible for managing the pool of funds. They decide which collateral to accept, set risk parameters, and allocate funds.

Simply put, they were like fund managers, using other people's money to lend and earn returns. Now, these "fund managers" are all trapped by Stream's collapse:

• MEV Capital - $25.42 million: An investment firm focused on MEV (Maximum Extractable Value) strategies. They have investments across multiple blockchains.

For example, the Euler market on the Sonic Chain has deposited 9.87 million xUSD and 500 xETH; there is also $17.6 million in xBTC exposure on Avalanche (272 BTC were lent out).

• Varlamore - $19.17 million: They are the primary funding provider on Silo Finance, with exposure distributed across:

Arbitrum has 14.2 million USDC, accounting for almost 95% of the market.

There are also approximately 5 million Varlamore funds managed by Avalanche and Sonic, which are held by institutions and large investors. This event could lead to large-scale redemptions.

• Re7 Labs - $14.26 million: Re7 Labs launched a dedicated xUSD marketplace on Euler of the Plasma chain, with all $14.26 million in USDT.

Other minor players who may be affected include:

• Mithras : $2.3 million, focusing on stablecoin arbitrage
• Enclabs : $2.56 million, spanning both Sonic and Plasma chains.
• TiD : $380,000, a small amount but likely their entire fund.
• Invariant Group : $72,000

These Curators certainly weren't gambling with the deposited funds; they must have assessed the risks. However, when the upstream protocol Stream encounters problems, all downstream risk control measures become very passive.

Is the market entering a bear market, triggering a crypto-version of the subprime crisis?

If you've seen the movie "The Big Short," what's happening now might seem familiar.

In 2008, Wall Street packaged subprime loans into CDOs, and then into CDO², which rating agencies labeled AAA. Today, Stream amplifies user deposits threefold through this nested structure, and xUSD is accepted as "high-quality collateral" by major lending platforms. History doesn't repeat itself, but it certainly rhymes.

Stream previously claimed to have $160 million in deposits, but this amount actually translated into $520 million in assets. How did they arrive at this figure?

DefiLlama has long questioned this calculation method, which involves a nested loop of loans, essentially calculating the same amount of money repeatedly, which is a manifestation of inflated TVL.

The contagion path of the subprime crisis was: mortgage defaults → CDO collapse → investment bank failures → global financial crisis.

The path this time is: Balancer hacked → Stream bank run → xUSD decoupled → $285 million in loans become bad debts → more protocols may collapse.

When using DeFi protocols for high-yield mining, people don't really ask how the money is made or where the profits come from when the market is good; however, if a negative event occurs, the loss could be the principal.

You may never know the true risk exposure of your funds in DeFi protocols. In the DeFi world, where there is no regulation, no insurance, and no lender of last resort, you can only protect the safety of your funds yourself.

The market isn't doing well; I wish you peace.