Loading Search...
The Arbitrum Security Council has frozen 30,766 ETH, worth approximately $71 million, on Arbitrum One with the funds being sent to intermediary address.
Author: Sahil Thakur
21st April 2026 – The Arbitrum Security Council has frozen 30,766 ETH, worth approximately $71 million, on Arbitrum One. The funds are directly tied to the KelpDAO bridge exploit that drained roughly $300 million on April 18, 2026.
High Signal Summary For A Quick Glance
Mudit Gupta
@Mudit__Gupta
@arbitrum Will the recovered amount be used to solely make Arbitrum rsETH whole or will it be distributed across the whole hack?
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,
04:39 AM·Apr 21, 2026
CryptoTelugu
@CryptoTeluguO
@arbitrum So you are telling me, In a few months, the same North Korean hackers could exploit this “tech” to move funds from any wallet on Arbitrum? 💻No private key. No consent. Just transfers 🤣At that point, this backdoor sounds scarier than the current hack https://t.co/tZMh02Pdpk
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,
04:33 AM·Apr 21, 2026
HEADBOY 🦇🔊
@NDIDI_GRAM
@arbitrum @AzFlin This is Good!!
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,
04:06 AM·Apr 21, 2026
High attention and emotional sentiment detected.
The emergency action took place on April 20 at 11:26 p.m. ET. According to an official statement from @arbitrum, the council identified a technical approach to move the funds to safety without affecting any other chain state or users. The ETH now sits in an intermediary frozen wallet and can only be moved through further Arbitrum governance action.
The Arbitrum Security Council operates as a multisig with emergency powers on Arbitrum One. In this case, it identified an address holding 30,766 ETH connected to the KelpDAO attacker.
After what the council called “significant technical diligence and deliberation,” it executed a method to transfer the funds to wallet address 0x0000000000000000000000000000000000000DA0. The approach did not require changes to the chain or impact other applications.
The council also confirmed it acted with input from law enforcement agencies regarding the exploiter’s identity. No details about the exploiter have been publicly disclosed.
Source: Arkham (X)
On April 18, 2026, an attacker exploited KelpDAO’s LayerZero-powered rsETH bridge contract. The attacker forged cross-chain messages by exploiting a flaw in the single-DVN configuration of the lzReceive flow.
In roughly 46 minutes, the attacker drained approximately 116,500 rsETH. That represented about 18% of the total rsETH supply, worth between $292 million and $300 million.
KelpDAO’s emergency pauser multisig halted contracts 46 minutes after the initial drain. This prevented two additional packets of approximately 40,000 rsETH each, saving an estimated $100 million in further losses.
The attacker funded initial wallets through Tornado Cash. Stolen rsETH was then immediately deployed as collateral across lending protocols including Aave V3, Aave V4, Spark, Morpho, Fluid, Compound, and Euler. This created bad debt across multiple platforms and triggered a wave of emergency pauses.
Aave was hit hardest. ETH utilization on the protocol spiked to 100% as the stolen collateral entered the system. TVL dropped and the $AAVE token price fell in response.
Multiple protocols froze markets or paused operations in response. The event highlighted how liquid restaking tokens like rsETH create interconnected risk across DeFi lending markets.
On-chain tracking showed the exploiter consolidating funds rapidly. Approximately 75,000 ETH (worth over $178 million) remained on Ethereum mainnet, while the rest moved to Arbitrum One. The mainnet portion remains unrecovered as of April 21.
Many in the community praised the Security Council’s swift action. The coordination between on-chain governance, law enforcement, and protocol teams demonstrated effective crisis response. It also restored some confidence in DeFi security after the exploit.
Others raised concerns about the precedent. A multisig with emergency powers freezing assets on a Layer 2 network challenges the decentralization narrative that Arbitrum promotes. If a small group can freeze funds in one case, the same power could theoretically apply in less clear-cut situations.
This tension is not new for Arbitrum. Similar debates arose in past discussions about sequencer interventions and the Security Council’s broad emergency capabilities.
The 30,766 ETH remains locked in the intermediary wallet. Only a formal Arbitrum governance action, likely a DAO proposal and vote, can move the funds from this point.
Coordination with KelpDAO, law enforcement, and affected users will determine how restitution works. KelpDAO, LayerZero, and affected protocols continue their investigations and remediation efforts.
The frozen amount represents a partial but significant recovery. At roughly $71 million, it covers about 24% of the total $300 million stolen. The majority of funds on Ethereum mainnet remain out of reach for now. Broader DeFi contagion was contained through rapid protocol pauses, but the incident exposed systemic risks in cross-chain bridges and restaking token collateral cascades.
This is not financial advice. Conduct your own research before making investment decisions.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
Arbitrum Freezes $71M in ETH Linked to KelpDAO Exploit
Crypto Hack Losses Hit $17B as DeFi Exploits Keep Climbing
Vercel Breach Exposes Token Risks After $2M Data Sale Claim
Aave Loses $6B in TVL After KelpDAO rsETH Exploit
Arbitrum Freezes $71M in ETH Linked to KelpDAO Exploit
Crypto Hack Losses Hit $17B as DeFi Exploits Keep Climbing
Vercel Breach Exposes Token Risks After $2M Data Sale Claim
Aave Loses $6B in TVL After KelpDAO rsETH Exploit
