Kelp DAO Exploiter Moves $175M in ETH After Arbitrum Freeze

Crypto News

The wallet linked to the Kelp DAO exploit began shifting stolen funds across multiple blockchain networks on Tuesday. On-chain investigators identified transfers totaling roughly 75,700 , worth approximately $175 million. The movement came hours after Arbitrum froze a portion of the stolen assets.

Blockchain investigator ZachXBT reported that funds began flowing through THORChain and privacy protocol Umbra shortly after the freeze. He identified three THORChain transactions totaling about $1.5 million and a separate transfer of roughly $78,000 through Umbra. Blockchain security firm PeckShield placed the total moved at approximately $176 million, with additional routes running through Chainflip and BitTorrent. Kelp DAO and LayerZero have not independently confirmed those figures.

Arbitrum's 12-member Security Council took emergency action before the transfers began. It froze 30,766  connected to the attack and moved those funds into an intermediary wallet that can only be accessed through Arbitrum governance. That action represented one of the few successful containment steps since the exploit was disclosed over the weekend.

The original attack occurred on Saturday. An attacker drained approximately 116,500 restaked ETH from Kelp DAO's LayerZero-powered rsETH bridge, equal to roughly 18% of the total rsETH in circulation. TRM Labs’ global head of policy, Ari Redbord, said the attacker used what appeared to be a forged message to trigger LayerZero's lzReceive function.