Arbitrum council freezes 30,766 ETH linked to KelpDAO hack
Arbitrum Security Council froze 30,766 ETH (about $71.5M) tied to a $292M KelpDAO exploit, moving the assets to an intermediary wallet accessible only via Arbitrum governance.
The Arbitrum Security Council froze 30,766 ETH, about $71.5 million, that it says was tied to a $292 million exploit of KelpDAO and transferred the tokens to an intermediary wallet that requires Arbitrum governance to unlock. The announcement was posted April 21, 2026.
Arbitrum wrote that the action followed input from law enforcement and that the funds are “no longer accessible to the address that originally held the funds.” The council added the assets “can only be moved by further action by Arbitrum governance, which will be coordinated with relevant parties.”
The Security Council is composed of elected signers with emergency powers to intervene on Arbitrum One, the layer-2 network. When activated, the council can freeze assets immediately and move them into addresses that require a governance vote to unlock.
KelpDAO, a liquid restaking protocol, reported losing roughly $292 million after attackers drained 116,500 rsETH tokens on April 18, 2026. LayerZero, the cross-chain messaging service involved in the incident, attributed the breach to North Korea-linked Lazarus Group and said attackers compromised multiple RPC nodes, poisoning two nodes and launching distributed denial-of-service attacks on a third. KelpDAO and LayerZero have disputed elements of the protocol configuration tied to the incident.
On-chain records show large transfers linked to the exploit before the freeze. One wallet associated with the attacker moved approximately $57.93 million and $117.48 million on the morning after the exploit. Blockchain investigator ZachXBT reported attempts to launder about $1.5 million from Ethereum to Bitcoin via Thorchain and roughly $78,000 routed through Umbra.
Arbitrum said any release of the frozen ETH will be handled through its governance process and coordinated with relevant parties, including law enforcement. Investigations by law enforcement and blockchain analysts are ongoing as teams trace funds and assess links to custodial on-ramps.
The action prompted online discussion about emergency governance and the balance between rapid responses to theft and decentralized control.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
