More than $10 billion has left Aave after the Kelp DAO exploit, but not all of the capital has gone to one place.
After the roughly $292 million exploit broke rsETH’s cross-chain support, users have distributed capital into safer, simpler places rather than rotating toward a direct replacement. Aave’s total locked value has fallen by around 40%, according to DeFiLlama data, as deteriorated collateral led to market freezes, stalled liquidations and forced deleveraging, pushing users to withdraw or close positions.
Some of that capital has moved into Maker-linked Spark, which has emerged as the clearest relative winner. Its TVL has risen around 10% as users rotate to infrastructure backed by Sky’s $6.5 billion stablecoin reserves, favoring tighter risk controls over open lending markets exposed to complex collateral.
Elsewhere, large liquid betting providers like Lido have remained relatively stable. That stability suggests that users are not abandoning ETH exposure, but rather removing layers of risk tied to recovery, rehypothecation, and cross-chain bridging.
A third hotspot of inflows is appearing in real-world asset protocols like Centrifuge and Spiko, which offer exposure to tokenized assets like Treasury bills and bonds.
At the same time, a significant portion of funds have moved into stablecoins, particularly USDC, as users move away from risk and wait on the sidelines rather than redeploying capital immediately.
Not all of Aave’s decline reflects capital turnover. Part of the drop is due to loan repayments and liquidation of positions, which automatically reduces the TVL without a new destination.
The result is a fragmented market response. Capital is flowing toward simplicity, controlled risk, and even cash, suggesting that post-Kelp, trust in shared collateral layers has weakened rather than moving elsewhere.
