It arises when the collateral's value falls below the debt before anyone can liquidate: a gap-down through the liquidation price, a stale-price-risk oracle, a chain too congested for liquidators, or collateral so illiquid that selling it crashes the price further.
Someone eventually absorbs it. Protocols may use a treasury or safety module to cover the hole, socialise the loss across depositors, or simply carry it as an unbacked balance, which quietly means depositors cannot all be made whole.
Large incidents have followed deliberate attacks in which someone opened an enormous position in an illiquid token, pumped it, borrowed against it and walked away, leaving the protocol with worthless collateral. Listing standards for exotic collateral are therefore a core safety question, not a growth one.
Related: on-chain-liquidation, lending-protocol, oracle-manipulation, protocol-treasury