USDC withdrawals from Jupiter JUP$0.256+0.4% Lend are open again. Jupiter Earn, the account that speaks for Jupiter Lend, said at 22:16 UTC on 30 October that "the liquidity crunch on Jupiter Lend has now ended" and that "USDC withdrawals are available again". That came about 13 hours after the crunch notice we reported on the morning of 30 October. Kamino Finance KMNO$0.031-7.5% had already resumed borrowing in its SOL/BTC Market, and early on 31 October Velocity, the relaunched Drift Protocol DRIFT$0.013+1.4% exchange, paused new deposits. All three moves follow the theft from Binance that began at 20:05 UTC on 29 October, which TRM Labs puts at $6.36 billion.
Jupiter Lend USDC vault: 6.7% withdrawable, most deposits still on loan
Jupiter Lend's USDC vault has spare cash again, though only a small slice of the vault can leave at once. Jupiter Earn said withdrawals were back "as liquidity has been replenished, bringing the spike in utilization back down". Utilization is the share of a vault's deposits that is lent out to borrowers. Jupiter has not said whether the cash came from new deposits or from borrowers repaying. Its original notice said either would refill the pool.
Jupiter Lend's public API, updated at 07:18 UTC on 31 October, showed 29.4 million USDC withdrawable from about 441 million supplied to the USDC vault, or 6.7%. At 09:18 UTC on 30 October, the same API had shown about 7,900 USDC withdrawable from roughly 420 million. The JupUSD vault went from less than one token withdrawable to about 1.93 million of 44.75 million supplied. The SOL vault barely moved: about 52,400 SOL of 209,600 supplied could be withdrawn, a quarter of the vault, as on 30 October.
How spare cash and withdrawal ceilings cap the USDC, JupUSD and SOL vaults
Two limits decide how much can leave a Jupiter Lend vault at any moment: spare cash and a rolling ceiling. Money that is lent out cannot be paid back to a depositor until a borrower repays or someone else deposits. On top of that, Jupiter's FAQ says withdrawal limits "expand gradually (25% every 6 hours for most vaults, up to 50% for some)", protecting the system "from sudden large outflows". The statistics page in Jupiter's docs defines the withdrawable amount as the lesser of the two.
Read against those definitions, the vaults are held back by different things. The ceiling alone would let about 220 million USDC and 22 million JupUSD leave, according to the same API, so spare cash is what binds both dollar vaults. On our reading of Jupiter's formula, roughly 93% of the USDC supplied is still out on loan. The SOL vault sits exactly at its 25% ceiling, the limit it was also at on 30 October.
Earn program wallet activity falls back to pre-hack levels
Activity on the Jupiter Lend Earn program has settled along with the USDC vault. From 12:00 to 19:00 UTC on 29 October, between 43 and 73 wallets an hour signed transactions with the program, according to Solana Compass program analytics. After the theft began the hourly count peaked at 165, at 00:00 UTC on 30 October, and stayed between 96 and 133 from 09:00 to 20:00 UTC. It dropped to 57 in the 22:00 UTC hour, when Jupiter Earn posted that the crunch had ended, and ran between 34 and 71 an hour from 00:00 to 05:00 UTC on 31 October. One person can sign from several wallets, and the series does not show where the new liquidity came from.
Hourly wallets on the Jupiter Lend Earn program peaked at 165 at 00:00 UTC on 30 October and were back to 34-71 an hour on 31 October, against 43-73 on the afternoon before the Binance theft.
View on Solana Compass βKamino resumes SOL/BTC Market borrowing after almost 17 hours
Kamino said at 14:50 UTC on 30 October that "borrowing has resumed in the SOL/BTC Market". The pause had begun at 22:03 UTC on 29 October, so new loans in that market were off for about 16 hours and 47 minutes. Kamino said its team "monitored onchain activity to assess any risk to the market or users" and "found no immediate risk", that "Kamino remained unaffected throughout", and that deposits, withdrawals and repayments "continued to process normally".
TRM Labs reports that the attacker used lending protocols directly: it supplied "60 million USDT to the lending protocol Aave and borrowed about 19,760 ETH". Aave froze its V3 markets on Ethereum on 29 October, Decrypt reported, and unfroze all its V3 and V4 markets on 30 October, according to The Block.
Velocity pauses new deposits and account creation as a precaution
Velocity said at 01:09 UTC on 31 October that "new deposits and new account creation on Velocity are temporarily paused", calling it "a preventative measure to keep stolen funds from entering the protocol". The perpetual futures exchange said it "has not been hacked or compromised", that withdrawals "are fully operational", and that existing accounts and open positions are unaffected. We covered the rebuilt exchange's change of leadership in September. The post said Velocity expects "to reopen deposits shortly", and no reopening update had appeared on Velocity's account by 07:30 UTC on 31 October.
