Decentralized finance (DeFi) platform Aave experienced the withdrawal of over $10 billion in user assets following a major security breach at Kelp DAO. Known for its blockchain-based liquid staking and restaking services, Kelp DAO has emerged as one of DeFi’s significant players in recent times. The exploit triggered a wave of outflows, leading to a nearly 40% drop in the total value locked (TVL) on Aave’s platform.
Sharp decline hits Aave after Kelp DAO incident
The breach exploited a vulnerability valued at $292 million, targeting a cross-chain collateral model. As a result, many Aave users sought simpler and safer alternatives. According to DeFiLlama data, the total assets held on Aave declined rapidly after the attack. Collateral on affected chains froze, liquidations were paused, and leverage decreased, all of which contributed further to the wave of withdrawals.
Many users chose to move a portion of their portfolios to Spark Protocol, which is affiliated with Maker. Spark’s TVL has increased by about 10% in recent days, backed by a robust $6.5 billion stablecoin reserve managed by Sky. This trend suggests that users are now favoring protocols offering more controlled risk structures over complex, open-ended collateralized lending platforms.
Shift to alternative DeFi protocols continues
Meanwhile, major liquid staking providers such as Lido have not seen a notable drop. This suggests that while investors are not abandoning their Ethereum exposure, they are actively trying to minimize additional risks from restaking, asset transfers, and cross-chain bridges.
At the same time, protocols connected to real-world assets—like Centrifuge and Spiko—have recorded significant capital inflows. These platforms provide access to tokenized versions of traditional financial instruments such as US Treasury bills and bonds, serving as a bridge between crypto markets and real-world finance.
Users take refuge in stable assets amid uncertainty
A growing number of investors opted to shift their assets—primarily into stablecoins like USDC. Rather than making new investment moves, they have chosen to wait out the uncertainty and waning trust in the market by holding lower-risk positions.
Crucially, not all the funds withdrawn from Aave were redirected to other protocols. Some users closed debts and liquidated positions, effectively pulling funds out of the market completely. This further reduced the TVL on Aave mechanically, independent of inflows to other DeFi protocols.
Overall, capital is being spread more widely across multiple platforms, reflecting shaken confidence in shared collateral layers and a renewed focus on risk management and simplified solutions within DeFi.
“Following the attack, users are steering their capital towards stablecoins and protocols with controlled infrastructure to reduce exposure to risks in complex layers. The market is beginning to question its confidence,” has emerged as a prominent interpretation of recent events.
