Overview
- The Kelp DAO exploiter moved about 75,700 ETH worth roughly $175 million on Tuesday, with on‑chain sleuths tracking early laundering through THORChain, Umbra, and routes into Bitcoin and Tron.
- Arbitrum’s Security Council froze 30,766 ETH late Monday after a 9‑of‑12 vote, moving the assets to a wallet controllable only by further governance in an action the council said included input from law enforcement.
- The April 18 breach forged a cross‑chain message that minted 116,500 rsETH, a liquid restaking token for staked ETH, by poisoning RPC nodes and exploiting a single‑verifier setup in LayerZero’s Decentralized Verifier Network.
- The attacker supplied the stolen rsETH to Aave V3 as collateral and borrowed large amounts of wrapped ETH, with Aave’s risk analysis modeling potential bad debt between about $123.7 million and $230.1 million as liquidity came under strain.
- LayerZero’s preliminary findings point to North Korea’s Lazarus Group and have fueled a public dispute with Kelp DAO over the 1‑of‑1 verifier configuration, while DeFi data providers report a sharp TVL drop of roughly $13–$14 billion tied to the shock.