Arbitrum Freezes $71M in ETH as Kelp-LayerZero Blame Game Escalates
Arbitrum’s Security Council voted 9-to-3 on Monday evening to freeze 30,766 ETH worth approximately $71 million, tracing those funds directly to last weekend’s Kelp DAO $292 million bridge exploit. The assets have been moved to an intermediary wallet accessible only through further governance action, meaning the attacker can no longer touch them. That recovery represents roughly 25% of the total loss — a meaningful start, not a resolution.
Arbitrum Acts, Accountability Remains Unsettled
The freeze took effect at 11:26 p.m. Eastern on April 20, following coordination with law enforcement. Council member Griff Green stated the group “did not make this decision lightly,” citing “countless hours of debates, technical, practical, ethical and political.” LayerZero has separately identified North Korea’s Lazarus Group as the preliminary suspect behind the attack, though no public confirmation has come from law enforcement. The action has drawn criticism from parts of the community who argue that an elected council freezing assets contradicts permissionless blockchain principles — a fair tension, but one that ignores the practical reality: without intervention, those funds were gone.
What triggered the exploit is where Kelp DAO and LayerZero remain firmly at odds. Kelp contends that the compromised 1-of-1 DVN (Decentralized Verifier Network) configuration was LayerZero’s own onboarding default, not a custom setup Kelp chose independently. LayerZero has framed the failure as infrastructure misuse. Both cannot be fully right, and the answer matters enormously for how the remaining losses get distributed. Kelp DAO has stated it is working with ecosystem partners on a recovery fund while legal coordination is assessed.
Bitcoin BTC$61,849.00▲0.94%
Ethereum ETH$1,640.87▲0.08%
Tether USDT$0.9992▼0.02%
BNB BNB$591.12▲0.74%
USDC USDC$0.9999▲0.00%
XRP XRP$1.12▼1.02%
Solana SOL$64.81▲0.46%
TRON TRX$0.3220▲0.27%
Figure Heloc FIGR_HELOC$1.03▲0.49%
Dogecoin DOGE$0.0843▼0.26%Aave Stares Down Two Bad Debt Scenarios
The attacker deposited 89,567 of the stolen rsETH tokens into Aave V3 as collateral, borrowing roughly $190 million in WETH and wstETH across Ethereum and Arbitrum. Aave’s risk manager LlamaRisk has now modeled two outcomes: if losses are spread across all rsETH holders, bad debt lands around $123.7 million with an estimated 15% rsETH depeg; if losses are isolated to Layer 2 networks, the figure climbs to more than $230 million, concentrated on Arbitrum and Mantle. The final figure depends entirely on how Kelp DAO allocates the shortfall — a decision that has not yet been made.
Aave moved quickly after identifying the exposure: it froze rsETH markets, reduced loan-to-value ratios to zero, and halted new borrowing against the asset. Smart contracts functioned as designed throughout. The protocol’s DAO treasury holds approximately $181 million, providing some buffer, though neither scenario is comfortable. AAVE was trading at $92.46, up just 0.03% over 24 hours, while ARB sat at $0.1267, up 0.65% — markets pricing in containment, not confidence. Broader DeFi TVL told a starker story: Ethereum shed nearly 11% in 24 hours, Arbitrum dropped 9.97%, and Mantle fell close to 42%.
The infrastructure accountability question here is the one that deserves sustained attention. Single-verifier validation paths on cross-chain bridges are a known structural risk, and the industry has had enough warnings. Whether blame ultimately lands on Kelp’s configuration choices or LayerZero’s defaults, the outcome is the same: $292 million gone and a lending protocol facing a nine-figure shortfall. Better defaults and mandatory multi-verifier requirements are not optional upgrades at this point — they are prerequisites for cross-chain infrastructure that earns the trust it asks for.
