KelpDAO Weighs Three Post-rsETH Hack Options, Putting Its Credibility and Aave's Risk Buffer in Focus

Mars Finance reported that on April 20, DeFiLlama founder 0xngmi laid out three possible ways KelpDAO could respond to the rsETH hack. Each option comes with major trade-offs, and the eventual choice could become a stress test for both KelpDAO's reputation and Aave's ability to absorb losses. Scenario 1: Socialize the Losses Across All rsETH Holders Under this approach, KelpDAO would haircut every rsETH holder by 18.5%. Roughly 666,000 rsETH is currently posted as collateral across Aave, concentrated in highly leveraged positions on Ethereum mainnet and multiple L2s (assuming a 95% liquidation LTV). If losses are spread evenly, mainnet positions would be fully liquidated, creating about $216 million in bad debt. Umbrella could cover $55 million, and Aave's treasury could add $85 million, leaving an estimated $76 million gap. KelpDAO could try to close the shortfall by borrowing or selling AAVE (market cap about $510 million), but the burden would still be heavy for Aave, with losses shared across all users. Scenario 2: Protect Mainnet rsETH, Write Off L2 rsETH KelpDAO could choose to honor only mainnet rsETH and treat L2 rsETH as effectively worthless. Around $359 million in rsETH collateral (at current oracle prices) sits on Aave's L2 deployments. If those positions are maximally leveraged, bad debt could reach roughly $341 million, with no coverage from Umbrella. Aave would be left relying on its treasury or external borrowing and might have to abandon the most affected networks—Arbitrum, Mantle, and Base—setting the stage for market failures on those chains. This option limits the immediate hit to Aave mainnet but risks severe reputational damage to L2 ecosystems and potential knock-on effects. Scenario 3: Reimburse Only Pre-Hack Holders Using a Snapshot (Hard to Implement) A third path is to fully compensate only addresses that held rsETH at the time of the exploit, using a pre-attack snapshot, while leaving later buyers or recipients to absorb losses. The analysis notes that flows after the incident have been extensive, and because DeFi protocols function as pooled liquidity, separating "clean" deposits from later activity is not technically feasible in practice. The attacker borrowed $124 million on Aave mainnet and $18 million on Arbitrum; after Umbrella coverage, remaining losses are estimated at about $91 million. While a snapshot-based approach could, in theory, limit systemic spillover, it is viewed as impractical and likely to invite legal challenges and community disputes.