Arbitrum Security Council Freezes $71.5M in Ethereum linked to $292M KelpDAO Exploit

3 weeks ago 10

In brief

The Arbitrum Security Council has frozen 30,766 ETH worthy $71.5 cardinal linked to the weekend's KelpDAO exploit.
The funds tin lone beryllium moved by further enactment by Arbitrum governance, the assembly said.
The KelpDAO attackers, thought to beryllium North Korean hackers, person begun moving and laundering funds linked to the exploit.

The Arbitrum Security Council has frozen 30,766 ETH worthy $71.5 cardinal allegedly linked to the KelpDAO exploit, moving the funds to an intermediary wallet.

In a tweet, the assembly explained the “emergency action” was taken pursuing instrumentality enforcement input astir the exploiter's identity. Following the move, the funds are “no longer accessible to the code that primitively held the funds,” the assembly said, adding that they tin lone beryllium moved “by further enactment by Arbitrum governance, which volition beryllium coordinated with applicable parties.”

The Arbitrum Security Council has taken exigency enactment to frost the 30,766 ETH being held successful the code connected Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from instrumentality enforcement arsenic to the exploiter’s identity, and, astatine each times,…

— Arbitrum (@arbitrum) April 21, 2026

The Arbitrum Security Council consists of elected signers with emergency powers to support the layer-2 network during information incidents. When activated, the assembly tin instantly frost assets and determination them to wallets accessible lone done consequent governance votes.

The frozen funds from the alleged KelpDAO exploiter present beryllium successful an intermediary code that requires assemblage support done Arbitrum's governance process to access.

The frost sparked statement regarding layer-2 governance and the resultant trade-offs betwixt accelerated information effect and decentralization, with Arbitrum’s quality to unilaterally frost funds during emergencies attracting some praise and criticism online.

The KelpDAO exploit

KelpDAO, a liquid restaking protocol, suffered a $292 cardinal exploit connected April 18 erstwhile attackers drained 116,500 rsETH tokens. In the aftermath of the hack, LayerZero attributed the attack to North Korea's Lazarus Group.

The attackers allegedly compromised RPC nodes successful LayerZero's network, poisoning 2 nodes portion launching DDoS attacks connected a third. In the aftermath of the incident, a dispute emerged betwixt LayerZero and KelpDAO implicit information configurations, with each enactment pointing to antithetic documentation standards for the protocol's setup.

The attackers person already started moving funds linked to the exploit. According to on-chain data, the wallet identified arsenic that of the KelpDAO hacker sent transfers of $57.93 cardinal and $117.48 cardinal Tuesday morning, while blockchain researcher ZachXBT reported that the KelpDAO attackers person begun laundering $1.5 cardinal from the KelpDAO exploit from Ethereum to Bitcoin via Thorchain, with a further $78,000 routed done Umbra.