#ArbitrumFreezesKelpDAOHackerETH

Arbitrum's Security Council made a decisive move on April 21, 2026, freezing approximately 30,766 ETH worth around $71 million. These funds were traced directly to the Kelp DAO exploit that unfolded just days earlier, marking one of the most significant emergency interventions in Layer 2 governance history.

The incident began on April 18 when attackers exploited a vulnerability in the LayerZero bridge to drain between $292 and $293 million in rsETH from Kelp DAO. A portion of those stolen assets was subsequently bridged to Arbitrum One and converted to ETH. Rather than allowing the funds to vanish into the laundering pipeline, the Security Council acted swiftly, transferring the assets to a governance-controlled intermediary wallet where they now sit frozen.

This freeze mechanism is not reversible by any single entity. Only a formal Arbitrum governance vote can unlock or return these funds, ensuring that any future movement requires genuine community consensus rather than centralized discretion. The move has already recovered roughly a quarter of Kelp DAO's total losses, though the remaining approximately 75,701 ETH, valued at $175 million, was rapidly relocated by the exploiter to fresh wallets and laundered through THORChain, Umbra Cash, and potentially converted to Bitcoin.

Blockchain analysts including ZachXBT and Arkham Intelligence have pointed toward North Korea's Lazarus Group as the likely perpetrators, a attribution that aligns with the sophisticated cross-chain laundering tactics observed. The freeze has ignited substantial debate across the DeFi ecosystem regarding the centralization risks inherent in Layer 2 security councils, the precedent this sets for fund recovery, and the broader implications for trust in decentralized finance protocols. Aave, which reportedly held over $200 million in exposure related to the exploit, appears to have emerged unscathed from a long-term perspective.

This event stands distinct from any prior Kelp DAO security incidents, including a separate exploit in 2022, and represents a new chapter in how Layer 2 networks balance decentralization ideals with practical security responses to major breaches.