More than $10 billion was withdrawn from Aave after the Kelp DAO exploit, but the capital is not all in one place.
After the ~$292 million exploit broke rsETH’s cross-chain support, users spread their capital to safer and simpler sites rather than moving to a direct replacement. Aave’s total value locked fell by about 40%, according to DeFiLlama data, as collateral depreciation triggered market freezes, blocked liquidations and forced deleveraging, pushing users to withdraw or close their positions.
Some of this capital was transferred to Maker-linked Spark, which became the clearest relative winner. Its TVL has increased by around 10% as users shift to infrastructure backed by Sky’s stable reserves of $6.5 billion, driving tighter risk controls in open-end loan markets exposed to complex collateral.
Elsewhere, large liquid staking providers like Lido have remained relatively stable. This stability suggests that users are not abandoning exposure to ETH, but are removing layers of risk related to re-mortgage, re-mortgage, and cross-chain bridges.
A third pocket of inflows appears in real-world asset protocols such as Centrifuge and Spiko, both of which offer exposure to tokenized assets such as Treasuries and bonds.
At the same time, a significant portion of funds have shifted to stablecoins, particularly USDC, as users abandon risk and wait on the sidelines rather than immediately redeploy capital.
Aave’s decline doesn’t just reflect capital turnover. Part of the decline comes from the repayment of loans and the unwinding of positions, which mechanically reduces the TVL without a new destination.
The result is a fragmented market response. Capital is flowing toward simplicity, risk control, and even liquidity, suggesting that after Kelp, trust in layers of shared collateral has weakened rather than shifted elsewhere.
