Aave Loses $16 Billion in Deposits After KelpDAO Hack — Spark Protocol Is the Unexpected Winner

The fallout from the KelpDAO rsETH exploit is still rippling through DeFi — and the numbers are getting harder to ignore. Aave, the largest lending protocol in the space, has seen its total deposit volume collapse from $45.8 billion before the incident to $29.6 billion today — a loss of $16.2 billion in deposits in a matter of days.

The damage extends beyond Aave, touching Morpho and reshaping the competitive landscape of DeFi lending in ways that will take months to fully understand.

The KelpDAO hack on April 18th — in which approximately $293 million was drained via a poisoned LayerZero bridge — didn’t just hurt KelpDAO. It triggered a confidence crisis across every protocol that had accepted rsETH as collateral. Aave was the most exposed. And its users didn’t wait for reassurance — they left.

Aave Bleeds. Spark Protocol Fills the Gap.

While Aave has been managing outflows, freezing markets, and attempting to restore user confidence, one protocol has been quietly absorbing the capital that left: Spark Protocol — the lending platform built on top of MakerDAO’s infrastructure.

According to Blockworks Research, SparkLend recorded nearly $1.4 billion in net deposits and approximately $350 million in loan growth in just two days following the rsETH incident. In five days total, Spark attracted $1.7 billion in new TVL.

Its token price doubled. Its market capitalization doubled. Yield returns for depositors also doubled — making it not just a refuge from Aave’s instability, but an actively attractive destination in its own right.

The Spark team noted that it had already paused rsETH and other low-usage assets as early as January — months before the KelpDAO exploit. That decision, which may have seemed overly conservative at the time, turned out to be exactly the right call. Spark had no rsETH exposure when the crisis hit. It was clean when Aave was not.

Spark has absorbed funds from some of DeFi’s largest participants — including institutional whales and the well-known wallet that bottom-fished with $500 million in February. When the biggest players in the room rotate out of a protocol, smaller participants tend to follow. That dynamic is playing out across the DeFi lending landscape right now.

Morpho tells a quieter version of the same story. Total deposits dropped from $11.7 billion before the rsETH incident to $10.2 billion — a $1.5 billion outflow. Morpho had rsETH exposure, though less systemic than Aave’s, and has seen users reduce positions without the same scale of panic that hit the larger protocol.

The KelpDAO Hacker Is Already Moving the Money

While DeFi protocols manage the aftermath, the attacker behind the KelpDAO exploit has been moving fast. According to on-chain analyst EmberCN, the hacker converted approximately 75,700 ETH — worth around $175 million — into Bitcoin in roughly 36 hours. The primary tool for the cross-chain conversion was THORChain, which processed approximately $800 million in volume during that window and earned around $910,000 in fees from the activity.

The speed of the conversion is notable. Moving $175 million across chains and into Bitcoin within a day and a half requires infrastructure prepared in advance — consistent with the premeditated operational pattern that investigators have documented across North Korean state-sponsored attacks in 2026. The funds are now significantly harder to trace or freeze than they were when they sat in Ethereum wallets.

Fluid Steps In With a Liquidity Solution

With aWETH trading at significant discounts on secondary markets — as much as 23% below par, according to Castle Labs — the DeFi project Fluid launched a dedicated redemption tool for users stuck in frozen Aave positions.

The tool allowed users to swap locked aWETH positions for wstETH or weETH directly, operating through Fluid’s Lite Vault — a structure that holds wstETH and weETH as collateral against ETH debt on Aave. In 48 hours, 166,772 aETH — approximately $400 million — moved through the tool. The redemption discount was approximately 2.2%, a fraction of the 23% haircut users faced on secondary markets.

For users who were trapped in frozen positions and watching the value of their collateral erode, Fluid’s tool represented a meaningful exit. The 2.2% cost of using it was far more palatable than the alternative — and the $400 million in volume in 48 hours confirms how many users were looking for exactly that kind of structured relief.

What This Moment Actually Means for DeFi

The events of the past week have compressed several months of competitive DeFi dynamics into a few days. Aave — the protocol that has dominated DeFi lending for years — is now visibly vulnerable. Not because of a flaw in its own code, but because of its exposure to an asset that was compromised elsewhere. That distinction matters technically. It doesn’t matter much to users who watched $16 billion leave.

Spark’s rise from $1.9 billion to $3.2 billion in TVL in days is not just a beneficiary story — it is a signal about what users value when trust breaks down. They moved to the protocol that had already made the conservative call, that had no rsETH exposure, and that was positioned to absorb capital rather than lose it.

2026 has now produced more than $1 billion in stolen crypto across dozens of protocols. More than $600 million was taken in the last two weeks of the month alone. The industry is not in a temporary rough patch. It is in a structural security crisis that is actively reshaping which protocols users trust — and which ones they quietly abandon when things go wrong.

Aave will almost certainly recover. It has the brand, the liquidity depth, and the institutional relationships to rebuild. But the speed at which $16 billion moved elsewhere is a lesson about how quickly trust evaporates in DeFi — and how permanently competitive dynamics can shift in the space of a single exploit.