{"id":71447,"date":"2026-04-21T08:58:21","date_gmt":"2026-04-21T08:58:21","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/arbitrum-security-council-freezes-30766-eth-from-kelpdao-exploiter-in-emergency-onchain-action\/"},"modified":"2026-04-21T08:58:21","modified_gmt":"2026-04-21T08:58:21","slug":"arbitrum-security-council-freezes-30766-eth-from-kelpdao-exploiter-in-emergency-onchain-action","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/arbitrum-security-council-freezes-30766-eth-from-kelpdao-exploiter-in-emergency-onchain-action\/","title":{"rendered":"Arbitrum Security Council Freezes 30,766 ETH From KelpDAO Exploiter in Emergency Onchain Action"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<p><strong>Key Takeaways:<\/strong><\/p>\n<ul>\n<li><span style=\"font-weight:400\">Arbitrum\u2019s Security Council froze 30,766 <span>ETH<\/span> worth roughly 70 million from the KelpDAO exploiter on April 21. <\/span><\/li>\n<li>Peckshield flagged the exploiter had initiated a native bridge withdrawal before the Security Council acted.<\/li>\n<li>The 30,766 ether now sits in a protocol-controlled address; its final disposition has not been announced.<\/li>\n<\/ul>\n<h2><span style=\"font-weight:400\">Arbitrum Acts Fast as KelpDAO Exploiter Attempts to Bridge Stolen Funds<\/span><\/h2>\n<p><span style=\"font-weight:400\">The Arbitrum Security Council identified the exploiter\u2019s holdings on Arbitrum One and moved the 30,766 ether to the protocol-controlled address 0x0000000000000000000000000000000000000DA0, as per CertiK Alert.<\/span><\/p>\n<figure id=\"attachment_807921\" aria-describedby=\"caption-attachment-807921\" style=\"width:727px\" class=\"wp-caption alignnone\"><figcaption id=\"caption-attachment-807921\" class=\"wp-caption-text\">Image source: X<\/figcaption><\/figure>\n<p><span style=\"font-weight:400\">The KelpDAO exploit drained approximately 292 million from the protocol via a Layerzero bridge attack targeting rsETH, with a portion of the stolen funds being moved to Arbitrum One after the initial breach.<\/span><\/p>\n<p><span style=\"font-weight:400\">As previously <\/span><a href=\"https:\/\/news.bitcoin.com\/zachxbt-flags-280m-kelpdao-exploit-hitting-ethereum-defi-lending-markets\/\"><span style=\"font-weight:400\">reported<\/span><\/a><span style=\"font-weight:400\"> by <span>Bitcoin.com<\/span>, the exploit triggered a full-blown <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-liquidity\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">liquidity<\/a> crisis across the <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-defi-decentralized-finance\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">decentralized finance<\/a> ( <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-defi-decentralized-finance\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">DeFi<\/a>) lending landscape while simultaneously pushing the industry\u2019s losses past the 600 million mark (over the past three weeks). <\/span><span style=\"font-weight:400\">Onchain analysts have <\/span><a href=\"https:\/\/x.com\/ParkKunwoong\/status\/2046099178997117265\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight:400\">pointed<\/span><\/a><span style=\"font-weight:400\"> to North Korea\u2019s Lazarus Group as the likely culprit behind the attack.<\/span><\/p>\n<h2>How the Arbitrum Security Council Stopped the Exploiter<\/h2>\n<p><span style=\"font-weight:400\">The freeze was a race against time as Peckshield <\/span><a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/2046434977307664661\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight:400\">flagged<\/span><\/a><span style=\"font-weight:400\"> that the exploiter had already initiated a native bridge withdrawal from Arbitrum back to the Ethereum mainnet. This was done using the 0xDA0 precompile, a standard mechanism for native ether transfers between the two networks. The Security Council completed its intervention before the transfer was finalized, trapping the 30,766 ether on Arbitrum.<\/span><\/p>\n<p><span style=\"font-weight:400\">Lookonchain <\/span><a href=\"https:\/\/twitter.com\/lookonchain\/status\/2046438391030706479\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight:400\">confirmed <\/span><\/a><span style=\"font-weight:400\">the freeze approximately 20 minutes after execution, noting the funds had been moved to an Arbitrum-controlled address. <\/span><span style=\"font-weight:400\">The Arbitrum Security Council holds elevated administrative powers over the network, allowing it to execute technical interventions in declared security emergencies. <\/span><\/p>\n<p><span style=\"font-weight:400\">However, this ability to unilaterally move funds has drawn some flak within the Ethereum community, primarily over centralization concerns for a network positioned as a decentralized layer-2.<\/span><\/p>\n<p> <!-- --> <\/p>\n<p><span style=\"font-weight:400\">The 30,766 ether remains in the protocol-controlled address. Arbitrum governance has not announced how the frozen funds will be handled or whether they will be returned to affected KelpDAO users. Lido separately disclosed approximately 21.6 million in rsETH exposure through its EarnETH product and indicated it may deploy a 3 million loss buffer, as <\/span><a href=\"https:\/\/news.bitcoin.com\/incident-report-llamarisk-aave-service-providers-detail-kelp-rseth-hack-across-ethereum-and-arbitrum-markets\/\"><span style=\"font-weight:400\">detailed <\/span><\/a><span style=\"font-weight:400\">in <a href=\"https:\/\/www.bitcoin.com\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">Bitcoin.com<\/a>\u2019s incident report coverage.<\/span><\/p>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><a href=\"https:\/\/news.bitcoin.com\/arbitrum-security-council-freezes-kelpdao-exploiter-eth\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways: Arbitrum\u2019s Security Council froze 30,766 ETH worth roughly 70 million from the KelpDAO exploiter on April 21. Peckshield flagged the exploiter had initiated a native bridge withdrawal before the Security Council acted. The 30,766 ether now sits in a protocol-controlled address; its final disposition has not [&hellip;]<\/p>\n","protected":false},"author":3947362404,"featured_media":71448,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/71447"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362404"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=71447"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/71447\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/71448"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=71447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=71447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=71447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}