Arbitrum Freezes $70M from KelpDAO Exploit, Intercepting North Korean Hackers

The Arbitrum Security Council has utilized its emergency powers to freeze and relocate 30,766 ETH, valued at over $70 million, tied to the April 18 KelpDAO exploit. The intervention targeted funds that cybersecurity analysts and law enforcement have attributed to North Korea’s state-sponsored Lazarus Group.

The Security Council Intervention

On April 21, 2026, the Arbitrum network announced that its Security Council took direct action against the exploiter’s address on the Arbitrum One Layer-2 (L2) network.

According to the official statement, the council acted with direct input from law enforcement regarding the attacker’s identity.

“After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users,” the network stated.

As of late April 20, the 30,766 ETH had been transferred to a new, intermediary frozen wallet. Arbitrum confirmed that these funds can only be moved through a future on-chain governance vote by the Arbitrum DAO, coordinated with relevant authorities.

The KelpDAO Exploit

The freeze follows the April 18 KelpDAO hack. The attacker exploited a vulnerability in KelpDAO’s cross-chain bridge infrastructure, which utilized the LayerZero protocol. (Read More: Timeline: Aave Freezes WETH as $292M KelpDAO Exploit Triggers Liquidity Crunch)

By using “RPC poisoning” tactics and exploiting KelpDAO’s single-verifier configuration, the hacker forged cross-chain messages to drain 116,500 unbacked rsETH tokens. While the majority of the $292 million remained on the Ethereum mainnet, the attacker bridged 30,766 ETH to Arbitrum One.

In a post-mortem report, LayerZero attributed the attack to the TraderTraitor subgroup of North Korea’s Lazarus Group.

Community and Governance Discussions

The action by Arbitrum has drawn commentary across the cryptocurrency sector regarding the use of emergency protocols against state-sponsored actors.

Blockchain security researcher Tayvano posted on X regarding the event, stating: “DeFi just rugged DPRK of $70M. This was surely an insane undertaking by a massive amt of people. I want to say thank you to EVERYONE who played a role… This is DeFi. DeFi fucking wins.”

The intervention has also prompted discussions regarding blockchain governance and decentralization as Arbitrum’s action displays a fundamental difference between Ethereum’s Layer-1 (L1) and its Layer-2 scaling networks. L2s like Arbitrum utilize Security Councils with the technical capability to override state changes in emergencies.

The intercepted $70 million currently remains locked in Arbitrum’s frozen wallet, pending an Arbitrum DAO vote to determine the process for handling the funds.

This article is published on BitPinas: Arbitrum Freezes $70M from KelpDAO Exploit, Intercepting North Korean Hackers

What else is happening in Crypto Philippines and beyond?