Arbitrum has moved to lock down a large portion of funds tied to the Kelp DAO exploit, stepping in as the fallout from the cross-chain breach continues to spread.
Summary
- Arbitrum’s Security Council seized 30,766 ETH linked to the Kelp DAO attacker and placed the funds in a frozen wallet pending governance action.
- The exploit drained 116,500 rsETH worth about $292 million, with early findings pointing to a coordinated node compromise tied to Lazarus Group.
- Kelp DAO halted contracts and blocked additional losses while disputes over LayerZero’s security setup and risk exposure across Aave continue to unfold.
According to a Tuesday update from Arbitrum, the network’s Security Council seized 30,766 ETH from an address linked to the attacker on Arbitrum One, placing the funds into a frozen intermediary wallet to prevent further movement.
Arbitrum said the intervention was carried out without interrupting network operations or affecting users and applications, with the assets set to remain locked unless governance decides on the next course of action.
“The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, weighed its commitment to the security and integrity of the Arbitrum community without impacting any Arbitrum users or applications,” the team said.
The move comes days after a major exploit targeting Kelp DAO’s LayerZero-powered bridge drained 116,500 rsETH, valued at around $292 million.
Early analysis from LayerZero linked the attack to North Korea’s Lazarus Group, pointing to a coordinated compromise of RPC nodes used within the decentralized verified network.
Investigators found that two nodes had been poisoned while a third was disrupted through a DDoS attack, allowing a malicious cross-chain message to pass validation and mint rsETH without backing.
Portions of the stolen assets were later routed into Aave V3, where the attacker used rsETH as collateral to borrow wrapped ETH, raising concerns about potential system-wide exposure.
Kelp DAO responded by pausing contracts and blacklisting wallets tied to the breach, blocking a further 40,000 rsETH, estimated at roughly $95 million, from being drained. Work on recovery and coordination with ecosystem partners is ongoing.
Security design dispute draws scrutiny
Tensions have surfaced between LayerZero and Kelp DAO over the setup used to secure the bridge.
LayerZero said the project relied on a 1-of-1 decentralized verified network configuration, arguing that such a setup created a single point of failure without independent validation.
“LayerZero and other external parties previously communicated best practices around DVN diversification to Kelp DAO,” the firm said, adding that the project “chose to utilize a 1/1 DVN configuration.”
Kelp DAO disputed that claim, stating the configuration was part of the default deployment framework.
“The 1-of-1 DVN setup is the configuration documented in LayerZero’s documentation and shipped as the default for any new OFT deployment,” Kelp said, adding that the design had been “affirmatively confirmed as appropriate” in earlier discussions.