Over $10 billion has exited Aave after the Kelp DAO exploit, but the capital hasn’t all gone to one place.
After the roughly $292 million exploit broke the cross-chain backing of rsETH, users have spread capital across safer, simpler venues rather than rotating into a direct replacement. Aave’s total value locked has fallen about 40%, according to DeFiLlama data, as impaired collateral triggered market freezes, stalled liquidations, and forced deleveraging, pushing users to withdraw or close positions.
Some of that capital has moved into Maker-linked Spark, which has emerged as the clearest relative winner. Its TVL has risen around 10% as users rotate toward infrastructure backed by Sky’s $6.5 Billion stablecoin reserves, favoring tighter risk controls over open-ended lending markets exposed to complex collateral.
Elsewhere, large liquid staking providers like Lido have held relatively steady. That stability suggests users are not abandoning ETH exposure, but stripping out layers of risk tied to restaking, rehypothecation and cross-chain bridges.
A third pocket of inflows is showing up in real-world asset protocols such as Centrifuge and Spiko, which both offer exposure to tokenized assets like T-bills and bonds.
At the same time, a significant share of funds has moved into stablecoins, particularly USDC, as users step out of risk and wait on the sidelines rather than immediately redeploying capital.
Not all of Aave’s decline reflects capital rotation. Part of the drop comes from loans being repaid and positions unwound, mechanically shrinking TVL without a new destination.
The result is a fragmented market response. Capital is flowing toward simplicity, controlled risk and even cash, suggesting that after Kelp, confidence in shared collateral layers has weakened rather than shifted elsewhere.