Overview
- Arbitrum’s Security Council, which completed the move at 11:26 p.m. ET Monday, froze 30,766 ETH in a governance‑controlled wallet linked to the exploit, locking down about a quarter of the stolen amount.
- Investigators say the attacker forged a cross‑chain message by corrupting verifier nodes on Kelp’s LayerZero bridge, which used a single checker, to mint 116,500 unbacked rsETH, a token that represents restaked ether.
- LayerZero reported preliminary links to North Korea’s Lazarus Group, and Arbitrum said it acted with input from law enforcement on the exploiter’s identity.
- The thief used the fake rsETH as collateral on Aave V3 to borrow large amounts of wrapped ether, pushing ETH pools to full use, driving about $9 billion in withdrawals, and forcing Aave to model bad‑debt outcomes between roughly $124 million and $230 million.
- Kelp DAO paused contracts and blacklisted wallets, which it says blocked another ~40,000 rsETH from being drained, while Kelp and LayerZero now dispute whether the one‑of‑one verifier setup was an unsafe choice or the default design.