Well, what you should do: being transparent about incidents, informing the public as soon as possible, help investigating the issue. Looks like you did that.

What you shouldn't do: replace the lost BTC. Especially if you informed all your members right after the Mt. Gox incident to do the obvious: don't use the same passwords everywhere. Probably that loss is a good motivation for the affected people to "invest" into good passwords and that might prevent them to loose much more in the future.

What you absolutely shouldn't do: Give out your donations. They are meant to support you and the site.