More than $10 billion left Aave after the Kelp DAO exploit, but the capital hasn’t all gone to one place.
After the approximately $292 million exploit broke rsETH’s cross-chain support, users spread their capital to safer, simpler locations rather than moving to a direct replacement. Aave’s total value has fallen by about 40%, according to DeFiLlama data, as compromised collateral led to market freezes, stalled liquidations and forced deleveraging, forcing users to withdraw or close positions.
Some of that capital has gone to Maker-linked Spark, which has emerged as the clearest relative winner. The TVL has risen about 10% as users move to infrastructure backed by Sky’s $6.5 billion stablecoin reserves, favoring tighter risk controls in open-ended credit markets exposed to complex collateral.
Elsewhere, major liquid strike providers such as Lido have held relatively steady. That stability suggests that users are not giving up exposure to ETH, but are removing layers of risk associated with remortgaging, remortgaging, and cross-chain bridges.
A third influx is emerging in real-world asset protocols such as Centrifuge and Spiko, both of which offer exposure to tokenized assets such as government bonds and bonds.
At the same time, a significant portion of funds have flowed into stablecoins, especially USDC, as users opt out of risk and wait on the sidelines rather than immediately redeploying capital.
Not all of Aave’s decline reflects capital rotation. Part of the decline is due to loans being repaid and positions being unwound, causing the TVL to mechanically shrink without a new destination.
The result is a fragmented market response. Capital is flowing towards simplicity, controlled risk and even cash, suggesting that post-Kelp, trust in shared collateral layers has weakened rather than shifted elsewhere.