Arbitrum has frozen 30,766 ETH tied to the Kelp DAO exploit, with the assets valued at roughly $71 million at recent market prices. The funds were traced to the exploiter’s address on Arbitrum One and moved into a restricted intermediary wallet, where they will remain immobilized while investigations continue and governance weighs the next step.
Security Council isolates funds without interrupting the network
The action was carried out by Arbitrum’s Security Council as part of its response to a cross-chain DeFi attack that unfolded over the weekend. Arbitrum said the freeze did not affect network performance or user activity, and applications and transactions across the ecosystem continued operating normally. The move was aimed at containing identifiable assets quickly while leaving the final disposition of those funds to the chain’s governance process.
Arbitrum also said any additional action involving the frozen ETH will need formal approval through governance. Until that happens, the assets will stay locked.
Kelp DAO exploit drained about $292 million
The breach that triggered the response hit Kelp DAO, where attackers drained about 116,500 rsETH in a coordinated cross-chain exploit. Total losses reached nearly $292 million, making it one of the larger DeFi attacks in recent months.
Preliminary findings from LayerZero indicated that the exploit may be linked to Lazarus Group, a hacking organization described in the report as being affiliated with North Korea and known for targeting crypto platforms. That assessment is not final. Multiple parties are still reviewing transaction flows and the technical weaknesses involved in the breach.
LayerZero and Kelp DAO dispute the source of the flaw
LayerZero said Kelp DAO’s use of a 1-of-1 decentralized verified network configuration created a critical single point of failure. In its view, the lack of independent verification reduced the system’s ability to catch fraudulent cross-chain messages in real time.
Kelp DAO rejected that framing and said the disputed setup followed LayerZero’s default deployment model. That response has sharpened the debate over responsibility in cross-chain systems: whether fault should sit with the infrastructure provider or the application builder. The disagreement has spilled into a wider discussion about security standards and accountability across cross-chain protocol design.
Law enforcement input adds to the recovery effort
Arbitrum said law enforcement agencies provided intelligence during the response, particularly in identifying the exploiter and assessing possible recovery paths. For now, the network’s position is clear: isolate the traced ETH, preserve normal chain operations, and wait for governance to determine what happens to the frozen assets.