How DeFi Liquidations Work in 2026: Health Factors and Bad Debt

Every loan in decentralized finance rests on a promise that no human enforces. There is no credit officer, no collections department, and no bankruptcy judge. When a borrower on Aave or Morpho stops being safe to lend to, a piece of code sells their collateral automatically, in seconds, to whoever shows up to do it. That process is called liquidation, and it is the single mechanism that lets on-chain lending pay depositors a yield without a bank standing behind the money.

For most of DeFi’s history, liquidation was invisible plumbing. In 2026 it stopped being invisible. On October 10, 2025, the broader crypto market saw the largest liquidation event ever recorded, roughly $19 billion wiped out in a single day across 1.6 million accounts, according to CoinDesk research. Months later, a counterfeit-collateral exploit at KelpDAO left as much as $200 million in bad debt sitting on Aave, and in late August a manipulated price oracle forced about $36 million of liquidations on a single Morpho market. Each episode was a stress test of the same machine.

This is a guide to that machine: how a DeFi loan is measured, when it gets liquidated, who does the liquidating, why the discount they earn matters, and what happens on the rare day the whole thing fails to clear. Understand the liquidation engine and you understand both why on-chain credit can be safe enough to attract Wall Street and why it occasionally detonates.

Why On-Chain Lending Needs Liquidations at All

A bank can lend you more than your collateral is worth because it knows who you are, can take you to court, and is itself backstopped by deposit insurance and a central bank. A smart contract knows none of that. It cannot call your employer, cannot repossess your house, and has no lender of last resort. The only thing it can trust is collateral it already holds.

So on-chain lending is almost always overcollateralized: to borrow $70 you might lock $100 of ETH. The gap is not greed, it is the protocol’s entire margin of safety. As long as the collateral is worth more than the debt plus a buffer, the protocol can always make lenders whole by selling it. Liquidation is the act of selling it before that buffer disappears.

The catch is that crypto collateral moves fast. A token can fall 30% in an hour. If a protocol waited for a court date, the collateral would be worth less than the loan long before anyone acted, and the loss would land on the depositors who supplied the funds, because a DeFi lender has no equity cushion and no FDIC (a point regulators keep stressing, covered further below). Liquidation therefore has to be fast, automatic, and attractive enough that strangers will race to do it. Almost everything else in this article is a consequence of those three requirements.

The State of On-Chain Lending in 2026

Before the mechanics, it helps to see whose machines we are describing. Lending is the largest category in DeFi. By the net measure that DefiLlama tracks, the sector holds around $49 billion across more than 500 protocols; counted as gross deposits the figure is far higher, and it briefly touched a record near $130 billion in late 2025 before the market pulled back, per DL News.

The definitional mess is worth a pause. “Deposits” counts every dollar supplied; “net TVL” strips out the dollars that have been borrowed and re-supplied in leverage loops. Aave, the largest lender, reported deposits crossing $30 billion in August 2026 even as its net TVL sat closer to $18 billion, according to Crypto Briefing. Both numbers are honest; they measure different things. The table below uses net figures for comparability, and every one of these protocols liquidates a little differently.

The two big governance tokens tell their own story. AAVE traded around $125.72 and MORPHO around $2.53 on September 1, 2026, per CoinGecko, giving them market caps within a few hundred million dollars of each other despite Aave carrying roughly twice the deposits. We compared the two engines head to head in a separate piece; here they matter because their liquidation designs sit at opposite ends of one spectrum.

Collateral, LTV, and the Liquidation Threshold

Three ratios govern every position. The first is the maximum loan-to-value, or LTV: the most you can borrow against a given collateral at the moment you open the loan. Blue-chip collateral like ETH or wrapped Bitcoin might allow 80% or more; a volatile long-tail token might allow 30% or less.

The second is the liquidation threshold, always set a little above the maximum LTV. If ETH lets you borrow up to 80% of its value, its liquidation threshold might be 82.5%. The gap between those two numbers, that 2.5%, is a deliberate cushion: it means you cannot open a position that is already on the edge, and it gives the price room to wobble before anything happens.

The third ratio is where you actually are: your current LTV, which rises when your debt grows (interest accrues every block) or when your collateral falls in price. The moment your current LTV crosses the liquidation threshold, the position becomes eligible to be liquidated. Morpho compresses all of this into one parameter per market, the Liquidation Loan-To-Value, or LLTV: a market is defined with a single fixed LLTV (say 86%), there is no separate “maximum LTV,” and you simply cannot cross the LLTV without becoming liquidatable, per the Morpho documentation. Aave keeps the two-number design; Morpho collapses it to one. Same idea, different packaging.

Health Factor: The Number That Decides Everything

Rather than make borrowers track raw ratios, most protocols surface a single number: the health factor. On Aave it is the value of your collateral multiplied by each asset’s liquidation threshold, divided by the value of your debt. On Morpho it is collateral value times LLTV, divided by borrowed value. The formulas differ in detail but agree on the punchline: when the health factor is above 1.0 you are safe, and the instant it drops to 1.0 or below your position can be liquidated.

A worked example. You deposit $10,000 of ETH into a market with an 82.5% liquidation threshold and borrow $6,000 of USDC. Your health factor is (10,000 times 0.825) divided by 6,000, which is 1.375. Comfortable. Now ETH falls 25%. Your collateral is worth $7,500, your debt is still $6,000 plus a little accrued interest, and your health factor is (7,500 times 0.825) divided by 6,000, or about 1.03. One more red candle and you are liquidatable.

Two forces push the health factor down. The obvious one is a falling collateral price. The quieter one is the interest rate on your debt, which in most pools floats with utilization and can spike when the pool is heavily borrowed. When funding markets tighten, as they did through the Federal Reserve’s policy shifts of 2026, on-chain borrow rates climb too, and leveraged borrowers can watch their health factors erode even in a flat market. Our rundown of the September rate reset covers why that macro backdrop feeds straight into DeFi leverage. Experienced borrowers treat the health factor as a live gauge, not a set-and-forget number.

The Liquidation, Step by Step

When a position’s health factor falls below 1.0, nothing happens automatically inside the protocol; it simply flips the position to liquidatable and waits. The actual work is done by an outside party, a liquidator, who sends a transaction that does three things in one atomic step: repays some or all of the borrower’s debt, receives an equivalent value of the borrower’s collateral, and pockets a bonus on top.

How much of the debt can be repaid in one go is set by the close factor. Classic Aave and Compound capped a single liquidation at 50% of the debt, enough to nudge the borrower back to health without wiping them out. Aave V3 made this dynamic: if a position is only slightly underwater the close factor stays partial, but if the health factor falls far enough (below roughly 0.95) a liquidator can repay 100% of the debt at once, per the Aave documentation. Morpho took the simplest possible stance: there is no close factor at all, and a liquidator may repay up to the entire debt in one transaction, per its liquidation docs. Aave V4 adds a final refinement, a rule that if the debt left in a reserve after liquidation would be under $1,000, the liquidator must clear all of it, so the protocol is never left chasing dust positions too small to be worth liquidating.

The borrower experiences all of this as a sudden, involuntary sale of their collateral at a discount, executed by a stranger, with no warning beyond the falling health factor they could have watched themselves.

The Liquidation Bonus and Who Pays It

The bonus is the whole reason liquidators exist. If repaying $1,000 of someone’s debt let you claim exactly $1,000 of their collateral, no one would bother, because gas alone would make it a loss. So protocols let the liquidator claim collateral worth more than the debt they repay. On Aave the bonus is typically 5% to 10% of the seized collateral, set per asset, and higher for volatile collateral that is riskier to hold and sell. That premium is simultaneously the liquidator’s profit and the borrower’s penalty: the borrower loses the bonus on top of losing the collateral.

Morpho makes the bonus a formula rather than a governance choice. Its Liquidation Incentive Factor is min(1.15, 1 divided by (0.3 times LLTV + 0.7)), capped at a 15% bonus, per the Morpho docs. The design is deliberate: safer markets with high LLTVs get a smaller bonus (around 5% for an 86% market), because a large discount on a tightly-collateralized position could itself push the remaining collateral below the debt and manufacture bad debt. Riskier markets get a bigger bonus to make sure someone still shows up.

A newer generation of designs has pushed the penalty down hard. Fluid uses batched, tick-based liquidations with penalties as low as 0.1%, a fraction of the industry norm, according to a MixBytes technical review. Euler v2 inherits the reverse Dutch auction from Euler v1, where the bonus on large loans could fall below 0.7%, the cheapest liquidations in DeFi, as noted when The Block covered its relaunch. The tension is permanent: a bigger bonus recruits more liquidators and clears bad positions faster, but it also transfers more of the borrower’s money to the liquidator and, in a cascade, dumps more collateral onto the market at once.

Meet the Liquidators: Keeper Bots, Flash Loans, and MEV

Almost no liquidations are done by hand. They are executed by keeper bots, automated programs that watch every open position, recompute health factors on each new block, and fire a transaction the instant one crosses the line. Monitoring services now track health across all major protocols and react within seconds of an on-chain change, polling risky positions far more often than safe ones.

The clever part is that a liquidator often needs no capital of its own. Using a flash loan, a bot can borrow the funds to repay the debt, seize the discounted collateral, sell enough of it to repay the flash loan, and keep the bonus, all inside one transaction that reverts if any step fails. That turns liquidation into a nearly risk-free arbitrage, which is why competition is fierce.

That competition happens in the same arena as the rest of on-chain trading: the mempool, where bots bid up priority fees to have their liquidation land first, and where the profit is a form of maximal extractable value. Liquidation is one of the more socially useful kinds of MEV, since it keeps lenders solvent, but it is MEV all the same, and the same searchers who back-run your swaps are watching your health factor; our guide to MEV strategies maps that supply chain in detail. The upside for borrowers is that this army of bots also enables tools that protect you: smart-account wallets can now watch a position and automatically repay debt or add collateral before liquidation triggers, turning the keeper model to the borrower’s advantage.

Four Ways Protocols Liquidate

Not every protocol liquidates the same way. The differences come down to how each one balances three goals: recovering the debt quickly, protecting the borrower from an oversized penalty, and avoiding cascades.

The fixed-bonus model is the classic. The reverse Dutch auction is the efficiency play: instead of a flat 8% discount, the bonus starts near zero and ticks upward until it is juicy enough for someone to act, so the borrower pays only as much as the market truly requires. Aave V4 adopted exactly this, scaling the bonus with how deep underwater the position has fallen.

The most different design is Curve. Its crvUSD stablecoin uses an engine called LLAMMA, a specialized AMM that never liquidates a position in one shot. As the collateral price falls, LLAMMA continuously converts it into crvUSD across a range of price bands; if the price recovers, it converts back, as the Curve documentation explains. There is no health-factor cliff and no single liquidator payday, just a slow, automated rebalancing. The borrower pays for that softness through the spread and the risk of being left worse off if the price whipsaws, but they are never hit by a sudden, discrete liquidation. It is a genuinely different philosophy: manage the risk continuously rather than punish it discretely.

When the Oracle Lies, Liquidations Misfire

Every number in this article, the health factor, the LTV, the moment of liquidation, depends on one input: the price of the collateral. Protocols get that price from an oracle, and the oracle is the single most dangerous point in the whole system. If it reports a price that is too high, unsafe loans stay open and quietly rot into bad debt. If it reports one that is too low, or one that can be pushed too low, healthy borrowers get liquidated who should never have been touched.

Both failure modes hit in 2026. In March, an attacker who compromised a cloud key at Resolv minted tens of millions of a stablecoin and drained about $25 million from lending markets, exploiting the fact that its wrapped token was priced by a hardcoded oracle that never moved. As Omer Goldberg, founder of the risk analytics firm Chaos Labs, described it: “The oracle is hardcoded and thus never repriced. wstUSR was marked at $1.13 while trading at ~$0.63 on secondary markets,” in comments to The Defiant. A liquidation engine cannot protect a market whose prices are fiction.

The opposite failure, an oracle pushed to force liquidations, arrived in late August. On a third-party Morpho market, an attacker manipulated a Pendle-based price feed, buying the yield token to spike an implied rate and crush the price of the principal-token collateral, which triggered roughly $36.39 million of liquidations that the attacker then collected the bonus on, as reported by The Crypto Times. The underlying asset was fine; the oracle was the weapon. It is why Aave founder Stani Kulechov has argued that immutable price feeds, interest curves and parameters are a “bad recipe for lending protocols,” in remarks reported by Protos, and why audits alone do not settle the question: a contract can be provably correct and still be fed a poisoned price, a gap our look at formal verification examines closely.

Liquidation Cascades: When Selling Triggers More Selling

A single liquidation is harmless. The danger is reflexivity: liquidators sell seized collateral into the market, that selling pushes the price down, the lower price pushes more positions below their threshold, and those get liquidated too. In thin liquidity, the loop feeds itself.

The clearest illustration is the record set on October 10, 2025, when a macro shock erased roughly $19 billion of leveraged positions in a single day and wiped out 1.6 million accounts, the largest liquidation event crypto had ever seen, per CoinDesk. Most of that was centralized-exchange perpetual futures rather than on-chain collateral loans, a distinction worth keeping straight: perp liquidations close a leveraged bet, while lending liquidations sell real collateral to repay a real loan. But the mechanic is identical, and on-chain markets felt the same downdraft, with borrow rates spiking and health factors collapsing across every major pool at once. When the market moves like that, the calm-day assumptions behind our year-end price outlook get tested in minutes rather than months.

Cascades are worst when collateral is correlated. If a lending market accepts three tokens that all move together, a shock to one is a shock to all three, and the buffer that looked ample in calm markets evaporates. This is the argument for isolated markets, where each collateral type is walled off, and against the temptation to accept exotic, thinly-traded collateral at generous LTVs. The collateral you can never sell fast is the collateral that turns a liquidation into a loss.

When Liquidation Fails: Bad Debt and Who Eats It

Liquidation is supposed to close a position while the collateral is still worth more than the debt. When it cannot, when the collateral is worth less than the loan by the time anyone acts, the shortfall becomes bad debt, and someone has to absorb it. In DeFi that someone is almost always the lenders who supplied the pool.

Here the architecture matters enormously. In a shared-pool design like Aave, bad debt is socialized: the loss is spread across everyone who supplied that asset, recorded as a protocol deficit that a backstop is meant to cover. Aave’s backstop, called Umbrella, replaced the old Safety Module in 2026; stakers deposit aTokens and GHO that can be automatically slashed to cover a deficit, with staked GHO paying around 8.4% for taking that risk, per Blockworks. In an isolated design like Morpho, bad debt is contained: it falls only on the depositors of the single vault or market that took it, and it cannot spread.

2026 tested both approaches repeatedly.

The KelpDAO case is the cautionary one for liquidation specifically: an attacker minted counterfeit rsETH through a bridge flaw and borrowed real assets against it on Aave, leaving as much as $200 million in bad debt, per NewsBTC. No liquidation engine could help, because the collateral was never real; the loans were bad the moment they were made. The lesson, hammered home by Chorus One’s year-end review of the sector, is that the plumbing held even as the judgment failed. “DeFi’s architecture is resilient: Isolation worked. Liquidity returned. The system bent but did not break,” the firm wrote, but “DeFi’s risk culture is not resilient: Curators mispriced collateral, mis-sized positions, and treated credit-like assets as stablecoins,” in its report on 2025. We unpacked that curator meltdown in a dedicated post-mortem; the point here is narrower, that liquidation only works when the collateral behind a loan is real and can actually be sold.

A subtler version of the same problem haunts the real-world-asset lending now flooding in. Tokenized private credit and treasury funds can carry lock-ups and redemption windows measured in days or months, so a liquidator who seizes them cannot sell in seconds the way it can dump ETH. Risk managers such as Gauntlet have responded by pre-arranging whitelisted liquidators who agree to warehouse the collateral, an admission, visible in the levered-RWA strategies covered by Markets Media, that the standard sell-it-instantly model simply does not work for assets that do not trade instantly.

The 2026 Reckoning: Rebuilding the Engine

Each failure pushed the industry to reinforce the machine. The most consequential response came from Aave after the KelpDAO exploit. In mid-2026 the protocol adopted a binding four-layer risk framework covering asset risk, bridging risk, automated risk oracles and monitoring, and chain risk, as CoinDesk reported. It set hard floors: a minimum $50,000 bug-bounty requirement for any listed asset regardless of size, and, aimed straight at the KelpDAO failure, a mandate that any bridge carrying Aave exposure use at least three independent verifiers. Assets that cannot meet the standard are being off-boarded.

Other reforms target the liquidation moment itself. Morpho shipped pre-liquidations, letting a borrower pre-authorize a gentler, cheaper partial unwind before the hard threshold is ever reached. Real-time risk platforms from Chaos Labs and Gauntlet now feed protocols live parameter recommendations and circuit-breaker signals, turning risk management from a quarterly report into an always-on service. Even the bridge layer changed: after being exploited, the cross-chain messaging protocol behind KelpDAO dropped support for the single-verifier configuration that made the counterfeit possible. None of this makes liquidation foolproof. It makes the perimeter around it harder to poison.

How to Avoid Getting Liquidated

For anyone actually borrowing, the mechanics reduce to a short list of habits.

• Keep a real buffer. A health factor of 1.1 is not safe; treat 1.5 to 2.0 as normal for volatile collateral, and remember interest quietly erodes it over time.
• Know your collateral’s liquidation threshold and its bonus. High-bonus, low-threshold markets punish mistakes harder.
• Watch the oracle. Understand what feeds your market’s price and whether it can be stale or manipulated; hardcoded or thin-liquidity oracles are a red flag.
• Avoid correlated collateral and debt. Borrowing a stablecoin against ETH is very different from borrowing an asset that moves with your collateral.
• Prefer isolated markets you understand. Contained risk is worth more than a slightly higher yield in a pool you cannot see into.
• Automate. Use monitoring alerts and, where available, smart-account automation that repays or tops up before your health factor reaches 1.0.
• Do not post collateral you could never sell in a hurry. If a liquidator cannot exit it fast, neither can you.

What US Regulators Say (and Do Not)

A DeFi lending position is not a bank deposit, and US regulators are increasingly explicit about it. There is no FDIC insurance, no lender of last resort, and no servicer you can call; the liquidation is code, and if it fails, the loss is yours. Under Chair Paul Atkins, the SEC has taken a friendlier posture toward the sector, framing its “Project Crypto” agenda around clearer rules and even a possible innovation exemption for on-chain systems, and Atkins has said the agency is ready to write rules if Congress stalls, in a statement on regulating crypto assets. The CLARITY Act, which would split oversight between the SEC and the CFTC and carve out genuinely decentralized protocols, advanced through 2026 but had not become law by the time of writing.

None of that changes the core reality for a borrower or lender: the protections that make a traditional margin loan survivable, a broker who calls you, a regulator who supervises the liquidation, an insurer of last resort, do not exist on-chain. The liquidation engine is the only backstop, and it works exactly as well as the collateral, oracles, and parameters it is fed. That is the trade for permissionless, global, around-the-clock credit, and it is why understanding the engine is not optional.

Frequently Asked Questions

What is a liquidation in DeFi lending?

A liquidation is the automatic sale of a borrower’s collateral when their loan becomes unsafe, defined as the health factor falling to 1.0 or below. An outside liquidator repays part or all of the debt, takes the collateral plus a bonus, and the protocol stays solvent. There is no human approval; it happens in a single on-chain transaction.

What is a health factor and what number is safe?

The health factor is your collateral value adjusted by its liquidation threshold, divided by your debt. Above 1.0 you are safe; at or below 1.0 you can be liquidated. Because interest accrues and prices move, borrowers usually keep a buffer of 1.5 to 2.0 on volatile collateral rather than sitting just above 1.0.

How much do you lose when you get liquidated?

You lose the liquidation bonus, which is the discount the liquidator earns, on top of the collateral used to repay the debt. On Aave that bonus is typically 5% to 10%; on Morpho it is set by formula and capped at 15%; newer designs like Fluid and Euler can be well under 1%. The exact loss depends on the asset and how far underwater the position went.

Can you get liquidated even if you did nothing wrong?

Yes. If the price oracle your market relies on is stale, hardcoded, or manipulated, a healthy position can be marked as unsafe and liquidated wrongly, as happened in the August 2026 Morpho PT-reUSD attack. This is why the quality of a market’s oracle matters as much as your own health factor.

Who covers the loss when liquidation fails and leaves bad debt?

The lenders who supplied the pool. In shared-pool protocols like Aave the loss is socialized across all suppliers of that asset and may be absorbed by a backstop such as Umbrella; in isolated designs like Morpho it falls only on the specific vault that took the risk. A DeFi lender has no FDIC insurance, so bad debt ultimately lands on depositors.

Yuki Tanaka is a DeFi correspondent at HOGE Wire, covering on-chain credit and market structure.