{"id":96349,"date":"2026-04-21T10:48:51","date_gmt":"2026-04-21T07:48:51","guid":{"rendered":"https:\/\/u1f987.com\/en\/?p=96349"},"modified":"2026-04-21T10:51:26","modified_gmt":"2026-04-21T07:51:26","slug":"arbitrum-freezes-30766-eth-amid-probe-into-kelp-hack","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/arbitrum-freezes-30766-eth-amid-probe-into-kelp-hack\/","title":{"rendered":"Arbitrum freezes 30,766 ETH amid probe into Kelp hack"},"content":{"rendered":"<p>The Security Council of the <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-a-layer%e2%80%912-solution-in-blockchain\">L2<\/a> network <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-arbitrum\">Arbitrum<\/a> has taken \u201cemergency measures\u201d and frozen 30,766 ETH (~$71.2m) stolen from the <a href=\"https:\/\/u1f987.com\/en\/news\/kelp-protocol-loses-293-million-following-cross-chain-bridge-attack\">Kelp protocol<\/a>.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter\u2019s identity, and, at all times,\u2026<\/p>\n<p>\u2014 Arbitrum (@arbitrum) <a href=\"https:\/\/twitter.com\/arbitrum\/status\/2046435443680346189?ref_src=twsrc%5Etfw\">April 21, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cThe team acted with input from law enforcement regarding the exploiter\u2019s identity and, at all times, took into account its obligations to ensure the community\u2019s security and integrity without affecting users or applications,\u201d the statement said.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>The funds were moved to an \u201cinterim frozen wallet\u201d. The original address no longer has access\u2014project governance alone can now move the assets.<\/p>\n<p>Legitimate owners will receive the coins after approval.<\/p>\n<h2 class=\"wp-block-heading\">Debating decentralisation<\/h2>\n<p>Freezing crypto is contentious. Critics say it violates the technology\u2019s ethos. Supporters argue that blocking crime-linked funds bolsters a chain\u2019s security and integrity.\u00a0<\/p>\n<p>Many users criticised Arbitrum\u2019s actions and questioned the network\u2019s decentralisation.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">so a council can just freeze 30k eth and we\u2019re still calling this decentralized?<\/p>\n<p>\u2014 Sandy.ETH (@david_lee2085) <a href=\"https:\/\/twitter.com\/david_lee2085\/status\/2046436791625134194?ref_src=twsrc%5Etfw\">April 21, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cSo some council can just freeze 30,000 ETH, and we\u2019re still calling this decentralised?\u201d wrote a user going by Sandy.ETH.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>The episode also prompted jokes.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">is it truly decentralised??? <a href=\"https:\/\/t.co\/wxHCRP3QWa\">pic.twitter.com\/wxHCRP3QWa<\/a><\/p>\n<p>\u2014 Nozomi (@NozomiNetwork) <a href=\"https:\/\/twitter.com\/NozomiNetwork\/status\/2046459296272335168?ref_src=twsrc%5Etfw\">April 21, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Arbitrum Security Council member Griff Green responded to community criticism. He said the decision was not taken lightly: members spent \u201ccountless hours\u201d debating the freeze from technical, practical, ethical and political angles.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">I&#8217;m a member of the Security Council &#038; I can tell you we did not make this decision lightly, there were countless hours of debates, technical, practical, ethical and political.<\/p>\n<p>But all it takes for evil to triumph is for good men to do nothing, so today, we decided to do\u2026 <a href=\"https:\/\/t.co\/tArbmXwZKN\">https:\/\/t.co\/tArbmXwZKN<\/a><\/p>\n<p>\u2014 Griff Green \u2014 griff.eth (@griffgreen) <a href=\"https:\/\/twitter.com\/griffgreen\/status\/2046446942494802274?ref_src=twsrc%5Etfw\">April 21, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Green stressed that not all council members voted to freeze the assets; nine of 12 backed the measure.\u00a0<\/p>\n<h2 class=\"wp-block-heading\">Aave\u2019s bad debt\u00a0<\/h2>\n<p>Among those hit by the Kelp exploit was <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-aave\">Aave<\/a>. Earlier, Lookonchain <a href=\"https:\/\/u1f987.com\/en\/news\/investors-pull-more-than-8-6bn-from-aave-after-kelp-hack\">said<\/a> the incident left the protocol with a balance \u201chole\u201d of roughly $195m.\u00a0<\/p>\n<p>A risk manager at the lending platform LlamaRisk outlined two scenarios for how the bad debt could affect the ecosystem.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Update on rsETH incident:<a href=\"https:\/\/twitter.com\/LlamaRisk?ref_src=twsrc%5Etfw\">@LlamaRisk<\/a> has published a report outlining the rsETH incident, the immediate actions taken, its impact on Aave, and potential paths forward.<\/p>\n<p>All service providers have been working to assess the two potential bad debt scenarios on the Aave protocol.\u2026<\/p>\n<p>\u2014 Aave (@aave) <a href=\"https:\/\/twitter.com\/aave\/status\/2046321565197905982?ref_src=twsrc%5Etfw\">April 20, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>First scenario: losses are shared across all rsETH holders on Ethereum mainnet and L2s. Then Aave\u2019s shortfall would be about $123.7m, and rsETH could fall 15% against the leading altcoin.<\/p>\n<p>LlamaRisk stressed that, in that case, losses would be distributed more evenly across chains. wETH would \u201cabsorb most in absolute terms but hardly notice it relative to the depth of its reserves\u201d.<\/p>\n<p>Aave has a tool\u2014the Umbrella safety module\u2014to cover losses in wETH. Some 18,922 aWETH (~$43.7m) have completed a cooldown and are ready to be unstaked.<\/p>\n<p>Second scenario: the entire deficit falls on L2s (Arbitrum, Mantle). Then bad debt would reach $230.1m.<\/p>\n<p>LlamaRisk noted that Aave has about $181m in its treasury\u2014reserves that could be used to cover a potential shortfall.<\/p>\n<p>The day before, Kelp said it was continuing to assess the damage from the hack and options to safely restart the protocol.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"zxx\" dir=\"ltr\"><a href=\"https:\/\/t.co\/APBgpyA10x\">https:\/\/t.co\/APBgpyA10x<\/a><\/p>\n<p>\u2014 Kelp (@KelpDAO) <a href=\"https:\/\/twitter.com\/KelpDAO\/status\/2046332070277091807?ref_src=twsrc%5Etfw\">April 20, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Haseeb Qureshi, a partner at Dragonfly, argued that current risks do not imperil DeFi. In his view, Aave and similar protocols have sufficient capital to cover bad debts.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">DeFi learns through failures. Whether it&#8217;s from the collapse of Terra, broken auctions during Black Friday in 2020, or the stETH depeg in 2022, it has failed over and over again\u2014but with every failure, it improves.<\/p>\n<p>People talk all sorts of shit about this, but it&#8217;s no different\u2026<\/p>\n<p>\u2014 Haseeb \uff1e|\uff1c (@hosseeb) <a href=\"https:\/\/twitter.com\/hosseeb\/status\/2046311474763886769?ref_src=twsrc%5Etfw\">April 20, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cDeFi learns through failures. Whether it\u2019s from <a href=\"https:\/\/u1f987.com\/en\/news\/terras-death-spiral-how-and-why-luna-and-ust-collapsed\">Terra\u2019s collapse<\/a>, broken auctions during \u2018Black Friday\u2019 in 2020, or the stETH depeg in 2022\u2014with every failure, the ecosystem gets better. [\u2026] DeFi is not going anywhere,\u201d he wrote.\u00a0<\/em><\/p>\n<\/blockquote>\n<h2 class=\"wp-block-heading\">LayerZero blamed<\/h2>\n<p>Kelp\u2019s team also shared initial findings of the hack investigation. The developers laid blame on LayerZero, which earlier claimed the breach was caused by the project using a 1\/1 <span data-descr=\"decentralised verification network\" class=\"old_tooltip\">DVN<\/span> configuration.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cThe 1\/1 setup is described in LayerZero\u2019s documentation and is the default for any new <span data-descr=\"Omnichain Fungible Token \u2014 a token standard developed by LayerZero\" class=\"old_tooltip\">OFT<\/span> deployment. We have been running on their infrastructure since January 2024 and have stayed in contact throughout,\u201d Kelp noted.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>Representatives of the protocol added that DVN configuration was discussed during the L2 expansion and that the default setup was \u201capproved as meeting requirements\u201d.<\/p>\n<p>At the time of writing, LayerZero had not responded to Kelp\u2019s statements.\u00a0<\/p>\n<h2 class=\"wp-block-heading\">Justin Sun\u2019s proposal\u00a0<\/h2>\n<p><a href=\"https:\/\/u1f987.com\/en\/news\/what-is-tron-trx\">TRON<\/a> founder Justin Sun addressed the Kelp hackers and called for talks.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">OK \u2014 Kelpdao hacker, how much you want? Let\u2019s just talk. With KelpDAO\u2019s help, of course. It\u2019s simply not worth it to sacrifice both Aave and KelpDAO and let them go down over this hack. You can\u2019t spend $300 million anyway.<\/p>\n<p>\u2014 H.E. Justin Sun \ud83d\udc68\u200d\ud83d\ude80 \ud83c\udf1e (@justinsuntron) <a href=\"https:\/\/twitter.com\/justinsuntron\/status\/2045781043526148368?ref_src=twsrc%5Etfw\">April 19, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cHacker, how much do you want? Let\u2019s talk. With KelpDAO\u2019s help, of course. It\u2019s simply not worth sacrificing both Aave and KelpDAO and letting them go down over this hack. You can\u2019t spend $300m anyway,\u201d he wrote.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>Sun\u2019s motives remain unclear. Addresses linked to his HTX exchange, however, have moved hundreds of millions to Aave. According to <a href=\"https:\/\/protos.com\/someone-is-taking-advantage-of-htxs-reserves\/\">Protos<\/a>, as of December 2025 more than $1.4bn of the platform\u2019s <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-tether-usdt\">USDT<\/a> reserves sat in loans on Aave.<\/p>\n<p>An on-chain analyst known as EmberCN also noted that wallets affiliated with TRON\u2019s founder actively withdrew USDT from the lending protocol after operations were paused.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"zh\" dir=\"ltr\">\u53e6\u5916\uff0c\u4ed6\u51cc\u6668\u4e3a\u4e86\u628a\u5b58\u5728 Aave \u4e0a\u7684 1.74 \u4e07\u679a ETH \u53d6\u56de\uff0c\u901a\u8fc7 Swap \u628a\u5b58\u6b3e\u51ed\u8bc1 (aEthWETH) \u76f4\u63a5\u5356\u6210 ETH\uff0c\u635f\u5931\u4e86 310 \u679a ETH ($72 \u4e07)\u3002\u4e5f\u5c31\u662f\u6298\u4ef7\u4e86 1.8%\u3002<\/p>\n<p>\u7136\u540e\u628a\u6362\u56de\u7684\u8fd9\u4e9b ETH \u8f6c\u5b58\u5230\u4e86 Spark \u4e0a\u3002<a href=\"https:\/\/t.co\/NCZnNhezwY\">https:\/\/t.co\/NCZnNhezwY<\/a><\/p>\n<p>PS\uff1a\u56e0\u4e3a Aave \u76ee\u524d\u8fd8\u662f\u6682\u505c WETH \u7684\u63d0\u6b3e\u7684\uff0cETH \u60f3\u4ece Aave\u2026 <a href=\"https:\/\/t.co\/HT9JouZ5cS\">https:\/\/t.co\/HT9JouZ5cS<\/a> <a href=\"https:\/\/t.co\/4Q0FO2eAhB\">pic.twitter.com\/4Q0FO2eAhB<\/a><\/p>\n<p>\u2014 \u4f59\u70ec (@EmberCN) <a href=\"https:\/\/twitter.com\/EmberCN\/status\/2046411151614103959?ref_src=twsrc%5Etfw\">April 21, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201c[\u2026] the wallet executed five transactions, withdrawing a total of $274m in USDT and fully closing its position in <a href=\"https:\/\/u1f987.com\/en\/news\/what-are-stablecoins\">stablecoins<\/a> on the platform,\u201d the analyst noted.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>Other large withdrawers from Aave included the MEXC exchange and investment firm Abraxas Capital.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Due to the KelpDAO exploiter borrowing over 82,600 <a href=\"https:\/\/twitter.com\/search?q=%24ETH&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$ETH<\/a> ($195M) from <a href=\"https:\/\/twitter.com\/hashtag\/Aave?src=hash&#038;ref_src=twsrc%5Etfw\">#Aave<\/a> using <a href=\"https:\/\/twitter.com\/search?q=%24RSETH&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$RSETH<\/a> as collateral, bad debt has appeared on <a href=\"https:\/\/twitter.com\/hashtag\/Aave?src=hash&#038;ref_src=twsrc%5Etfw\">#Aave<\/a>.<\/p>\n<p>Many whales have withdrawn funds from <a href=\"https:\/\/twitter.com\/hashtag\/Aave?src=hash&#038;ref_src=twsrc%5Etfw\">#Aave<\/a>, causing its TVL to drop from $26.396B to $20.114B \u2014 a decline of $6.28B.<\/p>\n<p>Major withdrawals\u2026 <a href=\"https:\/\/t.co\/rhN28AMul9\">pic.twitter.com\/rhN28AMul9<\/a><\/p>\n<p>\u2014 Lookonchain (@lookonchain) <a href=\"https:\/\/twitter.com\/lookonchain\/status\/2045829961655984335?ref_src=twsrc%5Etfw\">April 19, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>In April, hackers also <a href=\"https:\/\/u1f987.com\/en\/news\/eth-limo-regains-domain-control-after-easydns-breach\">breached<\/a> the ENS gateway eth.limo and cloud provider Vercel.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Arbitrum\u2019s Security Council took \u201cemergency measures\u201d and froze 30,766 ETH (~$71.2m) stolen from the Kelp protocol.<\/p>\n","protected":false},"author":1,"featured_media":96350,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Arbitrum freezes 30,766 ETH tied to the Kelp hack, stoking a decentralisation debate.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1212,1335,44,1302,1138],"class_list":["post-96349","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-aave","tag-arbitrum-arb","tag-cybercrime","tag-justin-sun","tag-opinions"],"aioseo_notices":[],"amp_enabled":true,"views":"9","promo_type":"1","layout_type":"1","short_excerpt":"Arbitrum freezes 30,766 ETH tied to the Kelp hack, stoking a decentralisation debate.","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=96349"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96349\/revisions"}],"predecessor-version":[{"id":96351,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96349\/revisions\/96351"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/96350"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=96349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=96349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=96349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}