Ethereum Worth Tens of Millions Confiscated by Arbitrum Watchdog After Kelp DAO Falls Prey to Cyberattack
In a swift and decisive move, the Arbitrum Security Council took drastic measures to safeguard approximately $71 million worth of Ethereum, valued at 30,766 ETH, by imposing an emergency freeze. This decisive action was prompted by the recent Kelp DAO security breach, which occurred on April 19, and resulted in the exploitation of LayerZero's bridge infrastructure, leading to the theft of 116,500 rsETH, a liquid restaking token representing staked Ethereum holdings within the protocol. The total financial impact of this breach is estimated to be between $292 and $293 million.
As a result of the council's swift intervention, the compromised address that initially controlled these assets is now unable to access the frozen Ethereum. The emergency freeze, which became effective at 11:26 p.m. Eastern Time on April 20, was executed with the input of law enforcement, who had provided valuable insights into the identity of the perpetrators. The council's actions were guided by a thorough evaluation of the situation, considering various factors, including technical, practical, ethical, and political implications.
The secured funds account for roughly a quarter of the total stolen amount, marking the most significant single recovery effort to date. This move has sparked intense debate within the cryptocurrency community, with some users raising concerns about the potential implications of this action on Arbitrum's decentralized nature. The council's decision to freeze the assets was not taken lightly, with nine out of 12 community-elected members voting in favor of the resolution.
Griff Green, a council member, emphasized the gravity of their decision, highlighting the countless hours of deliberation and debate that preceded the vote. The council has confirmed that it worked closely with law enforcement authorities during the decision-making process, ensuring that the emergency measure did not impact any other users or decentralized applications operating on the network.
The emergency action has also intensified tensions between Kelp DAO and LayerZero, with both parties disputing accountability for the security failure. The perpetrators had leveraged stolen Kelp tokens as collateral for cryptocurrency loans on Aave's lending platform, generating uncollateralized debt throughout the broader decentralized finance ecosystem. Kelp DAO has announced plans to establish a recovery fund, in collaboration with ecosystem participants, to assess options for loss distribution and legal coordination.
The possibility of recovering additional stolen assets hinges on the attacker's movement of funds and whether other blockchain networks with comparable emergency capabilities decide to intervene. With $71 million now secured, any forthcoming negotiations about loss allocation will begin with this partial recovery, considering insurance claims, legal remedies, or treasury contributions. The incident serves as a reminder of the complexities and challenges associated with ensuring the security and integrity of blockchain networks.