Aave & Compound’s $290M Kelp DAO Hack Fix

The Hook

$290 million disappeared. And now the two biggest names in decentralized finance are scrambling to prove they can clean it up.

The Kelp DAO hack didn’t just drain a protocol — it sent shockwaves straight into the balance sheets of Aave and Compound, two pillars of the DeFi ecosystem that had exposure to Kelp’s rsETH tokens. When those tokens got exploited, the bad debt didn’t evaporate into the ether. It landed somewhere. And that somewhere turned out to be the ledgers of protocols that millions of users trust with their capital every single day.

Here’s what makes this moment genuinely unusual: rather than going quiet, deflecting blame, or letting governance debates drag on for months, both Aave and Compound moved fast. They unveiled coordinated technical plans to eliminate the bad debt and restore full backing for the compromised rsETH tokens at the center of the Kelp DAO exploit.

That’s not a small thing. In a space where “we’re looking into it” often passes for crisis communication, an actual technical roadmap — named, detailed, actionable — is a different posture entirely.

The question hanging over all of this isn’t whether Aave and Compound can survive a $290 million hit. They probably can. The real question is whether this moment reshapes how DeFi protocols think about collateral risk before the next exploit arrives — because if history is any guide, it will.

What’s Behind It

How rsETH became a liability, fast

To understand why Aave and Compound are on the hook here, you need to understand what rsETH actually is — and why protocols were so eager to integrate it in the first place.

Kelp DAO‘s rsETH is a liquid restaking token, a category of asset that became one of DeFi’s hottest narratives over the past cycle. The pitch is elegant: take staked ETH, restake it across additional networks to earn layered yield, and wrap the whole thing into a liquid token that users can deploy as collateral elsewhere. It’s yield-on-yield, and the DeFi appetite for it was enormous.

Aave and Compound — as the dominant lending protocols — naturally became destinations for that collateral. Users would deposit rsETH, borrow against it, and amplify their positions. The protocols collected fees. Everyone won, until they didn’t.

When the $290 million exploit hit Kelp DAO, rsETH’s backing became immediately suspect. Tokens that were supposed to represent real, fully collateralized claims on restaked ETH were suddenly worth less — potentially far less — than their face value. Any protocol holding rsETH exposure was now sitting on bad debt it hadn’t priced in.

That’s the mechanical trap. And it’s one that both Aave and Compound walked straight into, not through recklessness, but through the ordinary logic of DeFi composability.

The exploit didn’t break Kelp DAO — it exposed how fragile the whole composability stack really is.

The technical plan taking shape

What both protocols outlined goes beyond damage control messaging. The core objective is surgical: eliminate the bad debt that the Kelp DAO hack created on their books, and restore full backing for the affected rsETH tokens so that users holding positions tied to that collateral aren’t left underwater.

The specifics of how that gets executed matter enormously. Bad debt in DeFi lending protocols typically gets resolved through one of a few mechanisms — treasury injections, token buybacks, socialized losses spread across liquidity providers, or some combination of the above. Each carries different political and economic weight within the respective communities.

Aave and Compound both operate with governance tokens and on-chain treasuries, meaning any resolution plan has to navigate community approval before it can be implemented. The fact that technical plans have been unveiled publicly suggests that groundwork has already been laid — that core contributors and major governance participants have been aligned before the announcement went live.

That coordination, quiet and unglamorous as it is, may actually be the most underrated part of this story. Getting two separate protocols, with two separate governance structures, moving in roughly the same direction, at roughly the same speed — that’s harder than it sounds in a space where consensus moves at the pace of token voting.

Why It Matters

The collateral risk nobody priced in

The Kelp DAO fallout is a stress test that the broader DeFi ecosystem didn’t know it was taking. And the results are instructive in ways that go well beyond the specific protocols involved.

Liquid restaking tokens like rsETH were integrated into major lending markets with the assumption that their underlying collateral was robust — that the restaking infrastructure beneath them was battle-tested enough to hold. That assumption is now visibly cracked.

What Aave and Compound are confronting isn’t just a one-off cleanup job. It’s the realization that as DeFi composability deepens — as tokens get wrapped, restaked, re-wrapped, and deployed as collateral across multiple layers — the risk surface expands in ways that traditional credit risk models don’t fully capture.

A protocol that integrates a liquid restaking token isn’t just taking on the risk of that token. It’s taking on the risk of every protocol in that token’s collateral stack. The $290 million Kelp DAO exploit made that chain of exposure viscerally real.

For users, this creates a sharper question: how thoroughly are these protocols vetting the assets they accept as collateral? And who bears the cost when that vetting falls short?

Winners, losers, and the governance stress test

In the immediate term, the clearest losers are users who had rsETH-backed positions on Aave and Compound when the exploit hit. Their collateral degraded in value through no fault of their own, and their recovery depends entirely on how cleanly the technical plans get executed.

The clearest near-term winners — if this resolution lands well — are the governance tokens of both protocols. A swift, credible technical response to a major exploit is exactly the kind of event that can rebuild institutional confidence in a protocol’s risk management. Markets tend to reward decisive action in a crisis.

But here’s what most miss: the real stakes aren’t about Aave and Compound specifically. They’re about whether DeFi’s broader collateral ecosystem can mature fast enough to handle the risks its own innovation keeps creating.

• Aave and Compound — on the hook to execute technical plans cleanly or face governance backlash
• Kelp DAO — credibility shattered, with a long road to rebuild trust in rsETH
• rsETH holders — dependent on the restoration plan for full backing recovery
• Liquid restaking tokens broadly — facing renewed scrutiny over collateral integrity
• DeFi governance frameworks — under pressure to move faster and more decisively than they were designed to

What to Watch

The next 30 to 60 days will be defining — not just for Aave and Compound, but for how the DeFi ecosystem calibrates risk on liquid restaking assets going forward.

The technical plans are out. The governance processes are being engaged. But unveiling a plan and executing it are two very different things, and there are several specific signals worth tracking closely as this plays out.

On the protocol side, watch whether the bad debt elimination proposals clear governance votes at both Aave and Compound with strong majority support or whether they generate significant friction. Contested votes would signal deeper internal disagreement about who should bear the cost — and that disagreement has a way of slowing resolution timelines and spooking depositors.

On the market side, watch rsETH’s price trajectory relative to ETH. Full backing restoration, if executed credibly, should narrow any discount that opened up post-exploit. A persistent discount would suggest that the market doesn’t fully trust the cleanup plan — or the timeline for it.

And watch Kelp DAO itself. The protocol’s response, its communication with affected users, and whether it takes any active role in funding or supporting the resolution will say a great deal about its long-term viability.

Broader signals to track across the DeFi ecosystem:

• Collateral reviews — whether other major lending protocols quietly begin auditing their liquid restaking token exposures
• Governance velocity — how quickly Aave and Compound proposals move from proposal to on-chain vote to execution
• rsETH backing ratio — whether full collateral restoration is confirmed on-chain and verifiable
• New integrations paused — watch for lending protocols slowing or halting new liquid restaking token listings pending review

The $290 million number is arresting. But the more durable story here is structural. DeFi composability is a feature until it’s a vulnerability. The market’s reaction to how this resolution unfolds will set a precedent — either that major protocols can absorb and neutralize collateral shocks, or that the stack is more brittle than the yield numbers ever suggested.

Either way, the answer is coming soon. And it won’t be subtle.