On April 24, the Ethereum mining marketplace Golem executed a transfer of 1,000 ETH from two distinct treasuries to join an Aave-led rescue initiative for rsETH. This move followed earlier commitments from EtherFi, which proposed injecting 5,000 ETH into a special pool, and Lido Finance, which submitted a governance proposal to provide up to 2,500 stETH. Combined with Aave founder Stani Kulechov's personal pledge of 5,000 ETH, this self-styled DeFi United operation aggregates 13,500 ETH and 2,500 stETH. According to Woofun AI, these coordinated contributions were a direct response to the KelpDAO hack occurring one week prior, where the Lazarus hacker group sub-branch TraderTraitor exploited LayerZero DVN nodes to steal 116,500 rsETH valued at approximately $292 million. The stolen assets represented roughly 18% of the total rsETH circulating supply, creating an immediate liquidity crisis.

The structural composition of the pledged funds reveals significant variance in commitment conditions. Stani Kulechov and the EtherFi Foundation provided the most direct support, each withdrawing 5,000 ETH from their respective treasuries without attached conditions. Golem's 1,000 ETH was disbursed from a combination of Foundation and Factory treasuries, with explicit alignment to the Aave team's usage path. Conversely, Lido's contribution of 2,500 stETH remains conditional, requiring full funding coverage upon the completion of the overall rescue plan before release. At an ETH spot price of $2,400 during the incident, these four commitments totaled approximately $38.4 million, a figure that represents just over 30% of the lower-bound bad debt estimate.

Aave's official incident report outlines a bad debt range between $124 million and $230 million, creating a substantial gap that the initial $38.4 million injection cannot fully bridge alone.

However, a second layer of defense emerged on April 21 when the Arbitrum Security Council performed a temporary upgrade to the Inbox bridge contract, freezing 30,766 ETH worth approximately $71.5 million. Monitored by Woofun AI, this frozen capital consists of real WETH originally borrowed by the attacker from the Aave Arbitrum market. If returned via governance proposal, this action would directly burn 36,166.8 rsETH collateral, reducing the total unbacked rsETH from 112,204 to 76,037 and lowering the detachment ratio from 15.12% to 10.77%.

The third critical buffer is Aave's Umbrella Insurance Pool, specifically the WETH Umbrella module within the Ethereum Core, which held a collateral size of 23,507.63 WETH valued at approximately $54.06 million at the time of the incident. This mechanism, rolled out in late 2025 to replace the Safety Module, is designed to automatically slash before bad debt impacts depositors. Aggregating the $38.4 million from DeFi United, the $71.5 million frozen by Arbitrum, and the $54.06 million in Umbrella reserves yields a total defense fund of $163 million. This sum covers the lower scenario of $124 million with a surplus of $39.8 million but leaves a shortfall of $66.6 million against the higher scenario of $230 million.

The divergence between the $124 million and $230 million loss scenarios stems from the unresolved question of who bears the cost of the 112,204 arbitrarily minted rsETH. LlamaRisk, Aave's risk management provider, presented two distinct pathways in its April 20 report. The pro-rata route distributes the loss across all rsETH holders based on current supply, resulting in a uniform devaluation rate of 15.12%. Under this model, the Ethereum Core market absorbs a $91.8 million default, while L2 solutions including Arbitrum, Base, Linea, and Mantle collectively absorb $31.9 million, totaling $124 million. Mantle faces the highest proportional reserve gap at 9.54% despite a smaller absolute impact.

Alternatively, the isolation route assumes the mainnet rsETH collateral remains intact, isolating all losses to the L2 mapped versions of rsETH. This approach is logical given the hacker extracted original mainnet vouchers via the LayerZero bridge, leaving the cross-chained L2 rsETH without backing. Woofun AI noted that under this isolation scenario, the devaluation rate for L2 rsETH jumps to 73.54%, while the Ethereum Core remains unaffected. The financial burden shifts heavily to L2s, with Mantle facing a 71.45% reserve gap of $77 million and Arbitrum facing a 26.67% gap of $88.4 million, alongside other L2s contributing $64 million to a total loss of $230 million.

Aave is currently leaning toward the isolation route, emphasizing in an April 20 statement that rsETH on the Ethereum mainnet is well-collateralized. The ultimate path depends on how KelpDAO updates the rsETH LRT oracle price and cross-chain accounting caliber, factors outside Aave's direct control. For depositors, the $38.4 million rescue pool is not a compensation fund but a mechanism to restore the rsETH peg. Once the peg is restored, Aave can liquidate the attacker's 89,567 collateral positions to repay the 82,650 WETH borrowed, allowing the WETH pool utilization rate to drop from 100% and enabling withdrawals.

If the pro-rata route is chosen, the $163 million in combined defenses likely ensures full principal recovery for both Ethereum Mainnet and L2 depositors.

However, if the isolation route prevails, Ethereum Core remains safe while Umbrella insurance does not trigger, as its coverage is limited to the mainnet. In this bifurcated outcome, Mantle and Arbitrum WETH depositors face a $230 million loss against only $109 million in available recovery funds, leaving a $57 million shortfall that would proportionally impact their principal. The final resolution awaits KelpDAO's strategic decisions on asset recovery, a timeline expected to extend one to two weeks.