Three Possible Responses to the rsETH Hacker Incident: Balancing Bad Debt and Reputation, Testing KelpDAO's Credibility and Aave's Risk Tolerance

DefiLlama founder 0xngmi has outlined three possible courses of action that KelpDAO may take following the rsETH hacking incident. Each of the three paths has significant flaws, and the final decision will test KelpDAO's credibility and Aave's risk tolerance.

Path One: All users share the losses. KelpDAO will uniformly deduct 18.5% of the losses from all rsETH holders proportionally. Currently, there are about 666,000 rsETH collateralized across the Aave network, primarily highly leveraged on the mainnet and L2 (assuming all are at a 95% liquidation LTV). Once socialized losses occur, the equity of all positions on the mainnet will be completely wiped out, resulting in approximately $216 million in bad debt. The Umbrella protocol can cover $55 million in bad debt, and the Aave treasury will additionally bear $85 million, leaving a gap of about $76 million. KelpDAO may fill this gap by borrowing or selling Aave tokens (currently valued at about $51 million), but this would still put significant pressure on Aave, and all users would need to share the losses.

Path Two: Directly rug the rsETH holders on L2. KelpDAO will only guarantee the mainnet rsETH and consider the rsETH on L2 as worthless. Currently, Aave L2 has about $359 million in rsETH collateral (calculated at current oracle prices), and if all are calculated at maximum leverage, it would result in approximately $341 million in bad debt, which cannot be covered by the Umbrella protocol at all. Aave can only use the treasury or borrowing to save part of the market, most likely abandoning chains like Arbitrum, Mantle, and Base, which have the largest losses, leading to a collapse of these L2 markets. This option has a minor impact on the Aave mainnet but would severely damage the credibility of the L2 ecosystem and could trigger a chain reaction.

Path Three: Attempt to refund only the holders based on a snapshot taken before the hack, which is extremely difficult to execute. KelpDAO tries to fully refund only the rsETH holders based on the snapshot taken before the hack, while subsequent buyers or transfer holders would bear the losses themselves. However, since funds have significantly flowed after the attack, and the nature of DeFi protocols is liquidity pools, it is impossible to truly distinguish between different batches of depositors, making technical execution very challenging. The hacker borrowed $124 million on the Aave mainnet and $18 million on Arbitrum, and after deducting the coverage from the Umbrella protocol, there remains about $91 million in losses. Although this plan theoretically minimizes the spread of impact, its practical implementation is nearly impossible and could easily lead to legal and community disputes.