Back
Arbitrum Security Council Freezes 30,766 ETH Linked to KelpDAO Attack

Arbitrum Security Council Freezes 30,766 ETH Linked to KelpDAO Attack

According to Arbitrum, its Security Council froze 30,766 ETH tied to the April 18 KelpDAO exploit and moved the funds to an intermediary wallet that now requires governance action to unlock.

ETH
ARB
RSETH

Fact Check
Odaily's report 'Arbitrum 紧急冻结 KelpDAO 攻击相关资金， 30,766 枚 ETH 已转入受控地址' and PANews' report 'Arbitrum安全理事会冻结KelpDAO攻击者相关约3.07万枚ETH' independently match on the central claim: about 30,766 ETH tied to the KelpDAO attack was frozen by the Arbitrum Security Council and moved to a controlled intermediary wallet. Both explicitly identify Arbitrum's official X post as the upstream source. The fetched X post from The Block also repeats the same core facts. However, because the primary Arbitrum post itself could not be fetched in this run due to tool limits, confidence is medium rather than high. The available evidence supports the claim that Arbitrum-linked funds tied to the KelpDAO hack were moved to an Arbitrum-controlled address; the specific additional clause that a larger portion remains on Ethereum is not directly established by the validated sources here.
    Reference: 1
Summary

Arbitrum’s Security Council said it took emergency action to freeze 30,766 ETH linked to the April 18 KelpDAO exploit and moved the funds from an address on Arbitrum One to an intermediary frozen wallet. Arbitrum said the move was made with input from law enforcement regarding the exploiter’s identity and did not affect Arbitrum users or applications. Arkham separately identified the transfer as about $70.9 million to the address 0x0000000000000000000000000000000000000DA0. KelpDAO said the incident involved a forged cross-chain message tied to LayerZero-DVN/rsETH and thanked Arbitrum’s council, ecosystem stakeholders, and SEAL 911 for coordinating the response. The action also triggered renewed debate over decentralization, with supporters describing it as an extraordinary security intervention and critics arguing it highlighted the concentrated power of Arbitrum’s 12-member Security Council.

Terms & Concepts
  • LayerZero-DVN: A messaging verification setup used in cross-chain communication. KelpDAO said the incident was tied to a single-DVN configuration affecting rsETH.
  • rsETH: A restaked Ether-linked token associated with KelpDAO that was central to the exploit discussed in the report.
  • Arbitrum One: Arbitrum’s main Layer 2 network on Ethereum, where the exploiter-linked address holding the frozen ETH was located.