On April 21, the Arbitrum Security Council executed an emergency onchain action to freeze 30,766 ETH (approximately $70 million) held by the KelpDAO exploiter on Arbitrum One, preventing the funds from being bridged back to the Ethereum mainnet.
Swift Intervention by Arbitrum Security Council
According to CertiK Alert, the Arbitrum Security Council identified the exploiter’s holdings on Arbitrum One and moved the 30,766 ETH to a protocol-controlled address (0x0000000000000000000000000000000000000DA0). Earlier, Peckshield flagged that the exploiter had initiated a native bridge withdrawal to Ethereum mainnet using the 0xDA0 precompile. The Security Council completed its intervention before the withdrawal could finalize, trapping the ETH on Arbitrum.
The Exploit and Fund Flow
The KelpDAO exploit resulted in an estimated $292 million loss through a Layerzero bridge attack targeting rsETH. A portion of the stolen funds was subsequently moved to Arbitrum One. The incident triggered a liquidity crisis across decentralized finance (DeFi) lending platforms, pushing the industry’s total losses past $600 million in three weeks. Onchain analysts have attributed the attack to North Korea’s Lazarus Group.
Centralization Concerns Emerge
Lookonchain confirmed the freeze roughly 20 minutes after execution, noting the funds were moved to an Arbitrum-controlled address. While the Security Council holds elevated administrative powers to intervene in declared security emergencies, the unilateral ability to freeze funds has drawn criticism from some in the Ethereum community over centralization risks for a network marketed as a decentralized Layer-2.
Uncertainty Over Frozen Funds
The 30,766 ETH remains in a protocol-controlled address. Arbitrum governance has not announced how the funds will be handled or whether they will be returned to affected KelpDAO users. Separately, Lido disclosed an approximately $21.6 million rsETH exposure through its EarnETH product and indicated it may deploy a $3 million loss buffer. Further updates are awaited.