Since the freeze, ZachXBT reported that the attackers had begun moving funds from Ethereum mainnet to Bitcoin.<\/p>\n
Ethereum Layer 2 Arbitrum said that its Security Coucil has taken emergency action to freeze approximately 30,766 ETH, worth over $71 million, tied to this weekend’s KelpDAO exploit<\/a>.<\/p>\n Arbitrum announced on X<\/a> late Monday night that it acted with input from law enforcement, which had provided information about the exploiter’s identity. After what it described as significant technical diligence, the L2 said it executed an approach that moved funds without affecting any other chain state or Arbitrum users. <\/p>\n As of April 20 at 11:26pm ET, the funds were successfully transferred to an intermediary frozen wallet, where they can only be moved by further action from Arbitrum governance, per Arbitrum\u2019s X post.<\/p>\n On-chain investigator ZachXBT reported<\/a> this morning that since the Arbitrum freeze, the attackers had moved $1.5 million from Ethereum mainnet to Bitcoin via decentralized swap protocol Thorchain, as well as another $78,000 routed through Umbra.<\/p>\n The intervention follows what appears to be DeFi’s worst exploit this year so far. The original exploit<\/a>, which struck KelpDAO’s LayerZero<\/a>-powered bridge on April 18, saw an attacker mint approximately $293 million worth of unbacked rsETH and drain over $200 million in real WETH from Aave before markets could freeze \u2014 leaving the lending protocol with hundreds of millions in bad debt. <\/p>\n LayerZero said in a postmortem<\/a> published yesterday, April 20, that the attack is likely attributable to North Korean state-sponsored hacker group Lazurus Group.<\/p>\n The Arbitrum Security Council’s move marks a rare use of emergency governance powers to directly intervene in fund recovery from a public chain, with coordination from law enforcement signaling this incident has drawn regulatory attention.<\/p>\n YCC founder Duo Nine called<\/a> the move \u201cGood move for the users affected, bad new for decentralization,\u201d adding: <\/p>\n \u201cThis sets a precedent where with good justification any assets on Arbitrum can be taken from your wallet.\u201d<\/p><\/blockquote>\n On-chain security expert Taylor Monahan had a different take, characterizing<\/a> Arbitrum freezing funds as DeFi collectively \u201crugg[ing] DPRK of $70M.\u201d Monahan continued:<\/p>\n \u201cI want to say thank you to EVERYONE who played a role. Including those who pushed back [\u2026] DeFi fucking wins.\u201d<\/p><\/blockquote>\nDeFi Community Response <\/h2>\n