Arbitrum freezes $71M in ETH linked to Kelp DAO hack

Arbitrum’s Security Council froze 30,766 ETH, roughly $71.1 million, held in an Arbitrum One address linked to the Kelp DAO exploit and moved the tokens into an intermediary frozen wallet. Arbitrum posted the action on X and added that the freeze did not affect other chain state or user balances.

The freeze follows an attack on Kelp DAO on Saturday that drained about 116,500 rsETH tokens, valued at roughly $292 million. Kelp DAO is a cross-chain bridge that uses the LayerZero messaging protocol.

Arbitrum wrote that the Security Council acted with input from law enforcement on the exploiter’s identity and that the council considered community security and integrity when approving the freeze. The frozen ETH will remain in the intermediary wallet unless Arbitrum governance approves further steps.

LayerZero issued preliminary findings linking the activity to the North Korean-affiliated Lazarus group and criticized Kelp DAO’s use of a 1-of-1 decentralized verified network, or DVN, configuration. LayerZero said that configuration lacked independent verification to detect a fraudulent cross-chain message. Kelp DAO replied that the 1-of-1 DVN setup was the default configuration shipped by LayerZero.

Investigations into how the attacker gained control of the bridged rsETH and how assets were moved on Arbitrum are ongoing. Law enforcement is cooperating with platform teams to trace the exploiter and any proceeds.

A 1-of-1 DVN configuration gives a single verifier authority to confirm cross-chain messages. LayerZero’s comments identify the absence of independent checks as a factor that can leave a bridge unable to detect a fraudulent instruction.