Spark (SPK): Sky’s lender and capital allocator, and the unexplained $180M USDT exit

Spark Protocol is the lending and capital-allocation arm of the Sky ecosystem, not to be confused with Apache Spark or Bitcoin Spark. It borrows USDS from Sky, places that money in DeFi, centralised venues and tokenised assets, and sells the yield through a money market and savings vaults. DefiLlama counted about $6.67 billion across the group on 1 November 2026: SparkLend at $4.97 billion, the Spark Liquidity Layer at $2.69 billion and Spark Savings at $1.32 billion. Those three overlap, so they do not add up.

Its savings arm shrank about 18% in the week to 1 November. Almost all of that came from one vault, spUSDT on Ethereum, which lost about $182 million between DefiLlama’s daily readings dated 28 and 29 October. Onchain records show one address took out $180 million in three withdrawals on 28 October, in a week when the USDT market on SparkLend ran above 96% utilisation. No source says who holds that address or why it left, and Spark has not addressed it in the documents we read. This page explains how the machine works, who controls it, what the SPK token gives its holders, and which of those questions stay open.

What Spark Protocol is: a money market, an allocator, vaults and a token

Spark sits under Sky, the former MakerDAO, in the sense that matters most: Sky lends it the capital and Sky Governance signs off its changes. Spark is one of Sky’s Prime agents, a unit older governance texts called a Star or SubDAO. Spark’s documentation presents it as a capital allocator: the money comes from Sky’s stablecoin reserves and goes out to DeFi, centralised venues and real-world assets.

Four pieces make it up. SparkLend is the money market where users supply and borrow. The Spark Liquidity Layer, or SLL, moves Sky-sourced capital between approved venues. Spark Savings is a set of ERC-4626 vaults that pay depositors. SPK is the governance token.

The dependency runs both ways. Spark pays Sky a base rate on what it borrows and keeps the spread above it, so the business lives on the gap between that rate and what its venues pay. Its Q3 report put the captured spread at 0.31% on an average of $2.06 billion of allocated capital. That is a thin margin on a large balance sheet.

SparkLend: an Aave v3 codebase with rates set partly by governance

SparkLend is built on the Aave v3 code, including the 3.0.1 and 3.0.2 upgrades, according to Spark’s security page. It looks familiar to anyone who has used Aave: deposit collateral, borrow against it, get liquidated if the health factor drops below 1. Between 1 and 0.95, liquidators can repay up to 50% of the debt; at 0.95 or lower, up to all of it.

The main difference is pricing. DAI and USDS use a utilisation curve with a kink at 80%, and a governance-set rate anchors that kink. Below it, rates stay under the anchor. Above it, they climb faster. Because the SLL can add or remove stablecoins in the market, the borrower of those two assets pays something close to a policy rate instead of a price that floats with demand. Other assets, USDT among them, float on supply and demand.

On Ethereum, the only chain left, WETH, wstETH, weETH, WBTC and cbBTC can back new borrowing, while stablecoins are borrow-only. The list has been getting shorter. rETH has been frozen since 23 April 2026, and the BTC e-mode was removed, with remaining positions force-liquidated on 8 June 2026. Sky Governance wound down the Gnosis Chain deployment, fully deprecated in September 2026; suppliers there can still withdraw, and DefiLlama shows about $0.2 million left.

Prices come from the median of three feeds (RedStone, Chainlink and Chronicle), with an average if only two are valid and a single-feed fallback. For pegged collateral such as wstETH, weETH and WBTC, a peg-ratio oracle halts new borrowing if market price strays past a threshold set per asset. A Cap Automator scales supply and borrow caps with onchain depth between governance cycles. Spark says supplied collateral stays in the reserve and is not redeployed into outside strategies.

Spark Liquidity Layer: how the allocator is boxed in

The SLL is the part with no real twin at Aave. Governance approves venues in advance and gives each one a rate limit, built from a maximum amount, a regeneration slope and the amount last consumed. A venue with a zero limit is unusable. Automation wallets holding the RELAYER role then move funds inside those limits, with slippage floors on Curve, Uniswap v4, Aave and OTC operations.

Spark’s documentation states the threat model plainly: it assumes a relayer may be fully compromised. The contracts are meant to keep value inside the system, and a FREEZER role can cut off the relayer. A 1-of-2 Safe on the controller runs automation and rotates a hot-wallet signer. Spark says it holds no funds and can only allocate to approved venues. A single signature is a low bar, so the safety here rests on the rate limits being set well, not on the wallet.

Current integrations include Sky minting and burning, PSM swaps, Circle CCTP and LayerZero bridges, Aave-compatible markets, ERC-4626 vaults including Spark-curated vaults on Morpho, 1:1 stablecoin pools on Curve and Uniswap v4, OTC desks and ether staking routes. Eight networks are listed: Ethereum, Base, Arbitrum, Optimism, Unichain, Avalanche, Robinhood Chain and X Layer. At the end of September the SLL held $2.90 billion of allocations, of which $1.58 billion in SparkLend and $686 million in Morpho vaults.

Spark says the layer “has been operating without fault since November 2024”. That is the project’s own claim. We found no exploit of it in our searches, which is a weaker statement than an independent review.

Some routes have closed. The spell of 10 September 2026, executed on 13 September, set to zero the limits for Ethena USDe minting and burning, sUSDe cooldowns, Maple redemptions, Superstate USTB, Aave Core USDe, Morpho v1 DAI and USDS vaults, three Curve pools, B2C2, and Anchorage USDT and USAT routes. Spark’s page records the change without giving a reason, and we did not find one.

Spark Savings: vaults with no lockup and a loss order on paper

Spark sells two families of vault, and the difference is who sets the rate. The V2 vaults (spUSDC, spUSDT, spPYUSD, spETH and spUSDG) are operated by Spark, fed by the SLL, and priced by Spark Governance. sUSDS and stUSDS are Sky products, with rates set by Sky Governance, and sUSDC and sDAI are legacy vaults that remain open to holders. Readers new to this design can start with our guide to yield-bearing stablecoins.

There is no lockup. Each vault keeps an idle buffer of up to $10 million for instant redemptions. Anything larger goes through Savings Liquidity Intents: the SLL takes a request, unwinds positions and fills it, which Spark says “usually” happens “within a few minutes”. On Ethereum, intents cover spUSDC, spUSDT, spETH and spPYUSD. That promise depends on venues having cash available when the request lands, and that cannot be taken for granted in a market at 96% utilisation.

Spark also publishes a loss order. Spark’s own junior capital comes first (over $35 million in stablecoin equity, it says), then capital from other Primes, then srUSDS senior capital, which is planned and not yet deployed. After that come Sky’s surplus buffers and a SKY token backstop. Only then are losses spread across all USDS holders, Spark Savings vaults included. If a loss may reach the vaults, Spark can place them in recovery mode, which halts withdrawals. So “no lockup” holds in normal conditions, and the documents say when it stops holding.

Credora ratings are cited for the savings products. The spUSDT strategy page ranks SparkLend first, a Morpho blue-chip vault as overflow, and a Uniswap v4 USDT/USDS pool for swaps, with its only duration product, Maple syrupUSDT, offboarded in September. The page does not discuss a USDT depeg or who would bear that loss.

SPK token: votes, points and buybacks, but no stated cash right

Ten billion SPK were minted at genesis. Spark says further emissions are “permanently disabled” and cannot be re-enabled by Spark Governance, although Sky Governance can reverse that if Spark breaches its Risk Capital requirements. So the cap is firm against Spark and conditional against Sky. CoinGecko showed about 3.42 billion in circulation on 1 November 2026, about 34% of the total.

SPK began trading on 17 June 2025. Binance made it the 23rd project of its HODLer Airdrops programme, with 200 million SPK, or 2% of supply, for BNB holders. Spark’s airdrop claims closed on 17 December 2025.

Holders vote on Snapshot, in binding three-day polls. Staked SPK earns Spark Points, with no token yield stated, and Symbiotic adds points of its own. Staked SPK may later secure services, which brings a slashing risk whose details are not settled. Spark’s token page states no dividend or revenue share. The closest thing is a line in the Blockworks Token Transparency filing of 2 November 2025, which says all protocol revenue accrues to the Spark DAO treasury, under SPK holders’ control. Blockworks reviews such filings for completeness, not accuracy, and this one is marked partial.

SPK buybacks against the farming schedule

Buybacks have run since the spell of 26 February 2026. Each month Spark compares the USDS in its SubDAO Proxy, net of accrued savings yield, with a target value. A quarter of the excess goes to buybacks, as does all value above 200% of target. An executor then buys SPK through a 90-day onchain TWAP, and the SPK goes back to the SubDAO Proxy. The spell of 22 October transferred 341,970 USDS for this.

In Q3 2026 Spark bought 106.89 million SPK for $2.00 million, after 58.26 million SPK for $1.31 million in Q2. Compare that with supply. The farming schedule alone releases 1,137.5 million SPK a year in each of its first two years, or about 284 million a quarter by our arithmetic, assuming the schedule began around the June 2025 launch. That is more than two and a half times what Q3 buybacks absorbed. The team cliff also fell due around June 2026, one year after launch. Spark does not publish how much of that has been released, or the exact curve of the remaining 900 million. On these figures, buybacks do not offset the farming schedule.

Revenue: $29.4 million gross, $2.55 million left

Most headline figures for Spark are gross. DefiLlama showed $20.6 million of fees over 30 days and $398 million all-time on 1 November 2026, but only $1.31 million of revenue over 30 days. The second figure is what its methodology keeps for the protocol: on the Liquidity Layer, fees minus the Sky base rate plus a monthly offchain rebate; on SparkLend, the part that funds SPK buybacks. Quoting one for the other overstates the business by more than 15 times.

Spark’s Q3 2026 report, published on 29 October, gives the same picture. These are the company’s internal accrual estimates, not GAAP and not independently verified.

ETH looping made up 45% of SparkLend borrows, so a large part of the market is leveraged staking yield and would shrink if that trade stopped paying. Spark Institutional Lending through Anchorage had $212 million deployed. The USDT savings programme “moved to roughly breakeven”, and the report carries a $4.66 million accrued yield liability to depositors of spUSDT, spPYUSD and spUSDG at 30 September. The September settlement from Sky, $4,218,121, reached the treasury on 12 October.

The report gives SparkLend gross TVL of $8.51 billion at quarter-end, far above DefiLlama’s reading a month later. We could not establish what separates the two definitions, so the figures should not be compared directly.

October: one address took $180 million out of spUSDT, and nobody has said why

DefiLlama’s spUSDT line on Ethereum went from about $447 million on 5 October to about $731 million on 15 October. The Defiant reported that on 5 and 6 October a single wallet moved 150 million USDT from Aave into Spark Savings, as Aave USDT borrow rates reached double digits. It did not identify the wallet. Aave changed its USDT curve later in the month, as covered in our piece on its 92% kink.

The drop between the readings dated 28 and 29 October is nearly all spUSDT. The next vault, spUSDC on Ethereum, was flat on that step, at about $300 million. The vault contract times it more closely: its total assets stood at $622.8 million at 04:00 UTC on 28 October and $441.3 million at 20:00 UTC, so the money left on the 28th, not the 29th.

It was one address, in three steps: $30 million at 05:38 UTC, $50 million at 05:45 UTC and $100 million at 16:48 UTC. A separate contract called the last withdrawal on the holder’s behalf, which fits Spark’s Liquidity Intents route, though we did not confirm that. The address held about 228 million vault shares at the start of the day, more than a third of the vault’s shares on Ethereum, and kept about 54 million.

It is not the wallet in The Defiant’s report, at least not the same address. Its balance stayed at about 63 million shares through 5 and 6 October, then rose to about 257 million between 9 and 13 October.

USDT was tight on SparkLend that week. The Defiant, republished by KuCoin, reported utilisation above 99% earlier in the week and quoted Spark saying the supply rate “hit 18%+ this week”. On 29 October, about 322 million USDT was supplied, about 310 million was borrowed, utilisation stood at 96.29% and $11.95 million was free to withdraw. Supply APY had fallen back to 6.9%. The same report says the Liquidity Layer withdrew 14.52 million USDT from SparkLend on 28 October at 8:57 a.m. ET (12:57 UTC).

No source identifies the holder or gives a reason, and nothing shows that the rate spike caused the exit. The timing invites a story about yield-chasing money leaving, but that is an inference nobody has confirmed, and we do not offer it as the cause. We also do not know how the exit was funded, since each withdrawal was several times the $10 million buffer. Spark’s Q3 report, published the next day, covers the period to 30 September and does not mention it.

We found no recovery-mode announcement, and all three withdrawals cleared within a day, so there is no sign that redemptions were halted. This vault has moved like this before: DefiLlama shows Spark Savings at about $3.0 billion on 4 May 2026, with spUSDT near $1.49 billion, then $1.17 billion across all vaults on 1 August. Deposits of this size come and go in this product, and the buffer is small beside them.

Who controls Spark: Phoenix Labs, a Cayman foundation and Sky

The Blockworks filing lists the structure as of November 2025. The Spark Foundation is a Cayman Islands non-profit. Phoenix Labs, a private company whose jurisdiction the filing does not state, provides technical and operational services and is paid from disclosed operating expenses and SPK grants; “Protocol cashflows will not accrue to Phoenix Labs equity”, the filing says. SPK Company Ltd. is the party to its market-making agreements. The filing names Sam MacPherson as CEO, Nadia Alvarez as COO, Kris Kaczor as CTO and Lucas Manuel as head of smart contracts. A 4-of-7 ecosystem multisig handles token operations; the filing says signers come from several entities.

Decisions pass through the Sky Atlas, where the Spark Agent artifact fixes budgets, risk settings, asset listings, SLL integrations and new chains. Proposals come from holders of 1% of supply (100 million SPK) or from nested contributors such as Phoenix Labs. An Operational Facilitator reviews each one within seven days, a three-day Snapshot poll follows, and more than 50% of non-abstaining votes passes it. Delegates must be whitelisted by the Foundation and can be paid up to $4,000 a month each, capped at $20,000 a month in total.

The Spark Risk Council was removed from the Sky Atlas on 27 August 2026, and Spark’s page now says the Facilitator check is the only review before a vote. It does not explain the removal.

Timelocks are harder to pin down. Spark’s governance and security pages mention no delay and no admin multisig. Passed proposals become a Spark Spell, carried out through the Sky Spell process. Sky’s pause contract, MCD_PAUSE, reported a delay of 172,800 seconds (48 hours) when we read it onchain on 1 November 2026, and the Sky executive of 22 October, which covered Spark’s proxy spell, passed on 27 October at 12:26 UTC and executed on 29 October at 12:28 UTC. That fits a 48-hour wait for spells. It does not tell us about emergency paths, the powers of guardians and freezers, or who signs those multisigs: forum threads last active on 19 October are titled for guardian and curator key rotations and Morpho vault timelock compliance, but we did not read them.

Spark audits: what the reports found

Spark publishes audit folders by repository, and we opened the reports listed on this page. For the SLL controller, ChainSecurity’s review of 17 February 2026 and Cantina’s of 25 February 2026, both for version 1.10, report no critical, high or medium findings. Cantina lists two low-risk issues, both fixed, and six informational ones, three fixed and three acknowledged. Certora’s review of version 1.9.0, completed on 15 December 2025, is less clean: ten findings, one of them high severity and two medium. The high one was a way for a malicious relayer to steal funds through arbitrary Uniswap v4 positions, the threat the SLL is built around. The report marks it fixed, along with one medium. The other medium, on asset pricing in the Curve library, and five of the six low issues were acknowledged, not fixed. On Spark Vaults V2, ChainSecurity and Cantina both reported on 1 October 2025 with only low-severity findings at most; one of Cantina’s two low-risk issues was acknowledged, not fixed.

SparkLend’s own changes were reviewed by ChainSecurity on 15 March 2024, and the core rests on Aave v3 reviews such as Sigma Prime’s of April 2023. An audit covers one commit and one scope. We did not verify which version runs in production today, and clean reports say nothing about the risk choices that decide most outcomes here: which venues, how much, at what rate limit. A bug bounty on Immunefi lists a maximum of $5 million.

Incidents: no exploit found, and a freeze after KelpDAO

We found no exploit of SparkLend or the SLL. The nearest event came on 18 April 2026, when KelpDAO lost 116,500 rsETH, worth about $292 million, through a forged LayerZero message. CoinDesk reported that SparkLend and Fluid froze their rsETH markets, as Aave did. Spark’s USDT strategy page says SparkLend TVL grew about 50% in the days after, as capital moved from Aave, and that Spark Savings USDT stayed fully liquid; both are Spark’s own account. DefiLlama shows Spark Savings rising from about $2.0 billion on 28 April to about $3.0 billion on 4 May.

We found no SEC, MiCA, AMF or Consob action concerning Spark.

Spark against Aave, Morpho and Maple

SparkLend is the smaller rival to Aave, and it competes on stablecoin borrow rates anchored by governance and backed by Sky’s balance sheet. That edge has a cost: Spark’s fortunes depend on Sky’s base rate and on Sky Governance. Morpho is both competitor and venue, since $686 million of SLL money sat in Morpho vaults at the end of September. SparkLend fell from about $5.68 billion on 2 October to $4.97 billion on 1 November, while the SLL stayed near $2.7 billion.

Is Spark safe? Our risk rating of 3 out of 5

Coindaro rates Spark 3 on a scale of 1 to 5, where 5 is the riskiest. The rating covers the protocol, not the SPK price. On one side: we found no exploit, the audit reports are public, the rate limits assume a relayer can be compromised, and several layers of capital stand ahead of vault holders in the loss order.

On the other: Spark relies on Sky for capital and sign-off, its Risk Council is gone, a single address held more than a third of spUSDT on Ethereum, and the USDT market went above 99% utilisation in late October, with $11.95 million free on the 29th. Recovery mode can also halt withdrawals. An exploit, a halted vault or a loss reaching depositors would raise the rating.

What to watch next

The forum shows a thread for proposed changes in a 5 November 2026 spell, which is the next fixed date. srUSDS senior capital is planned but undated, and the details of SPK slashing have no date either. We found no dated roadmap from Spark. The open questions are simple ones: who holds the address that left spUSDT, why the Risk Council was removed, and how much team SPK is now in circulation. Coindaro makes no price forecast, and nothing on this page is investment advice.