aave ($AAVE) assembled a $230m private rescue fund in 48 hours to cover the rsETH exploit and still lost $9b in TVL. 34% drawdown. the rescue prevented insolvency but users voted with their capital anyway. 98% of rsETH collateral on aave was one recursive looping position. one entity. the code worked perfectly. the risk parameters that allowed 98% concentration in a single asset from a single strategy did not. this is the metric nobody tracks on lending protocols. not TVL, not audit count, not token price. collateral concentration ratio. when one position or one asset dominates a lending pool, you are not diversified. you are a counterparty to that position. check concentration before you deposit. the next crisis won't get a $230m rescue fund and the one that did still bled a third of its deposits