Leading Ethereum layer-2 blockchain Arbitrum on late Monday, freezed 30,766 ETH worth around $71 million that had been sitting in a wallet linked to Saturday’s $292 million KelpDAO hack. The funds now sit in an intermediary wallet that nobody can touch without a further Arbitrum governance decision.
The council confirmed the transfer completed at 11:26 pm Eastern Time on April 20. The address that originally held the funds no longer has access to them.
The council said it acted on information from law enforcement regarding the exploiter’s identity before executing the freeze. Arbitrum also confirmed that the action did not affect any users or applications running on the network.
“As of April 20 11:26pm ET the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action by Arbitrum governance, which will be coordinated with relevant parties,” the company wrote on its official X account.
“The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, weighed its commitment to the security and integrity of the Arbitrum community without impacting any Arbitrum users or applications,” Arbitrum stated.
KelpDAO is the issuer of rsETH, a liquid restaking token that tracks a user’s position in restaked ether. The exploit that triggered all of this happened on April 18, when an attacker found a weakness in KelpDAO’s cross-chain bridge infrastructure, which was built on top of the LayerZero protocol.
Security analytics firm D2 Finance reviewed the on-chain data and concluded that LayerZero’s core infrastructure was not at fault. The vulnerability has been identified as an OApp peer-trust bug. Through that compromise, the attacker gained control of a legitimately deployed KelpDAO peer contract.
Most of the $292 million stolen in the attack stayed on the Ethereum mainnet. The attacker moved 30,766 ETH across to Arbitrum One, which is the portion the Security Council has now locked down pending governance coordination with relevant parties.
