Kelp DAO Hacker Moves $175M in Stolen ETH After Arbitrum Freeze

A hacker exploited Kelp DAO's LayerZero-powered rsETH bridge on Saturday, draining approximately 116,500 restaked ETH worth around 18% of the total rsETH in circulation.

The attacker used a forged message to trigger LayerZero's lzReceive function, according to TRM Labs' global head of policy Ari Redbord. The hacker then began moving the stolen funds across multiple blockchain networks on Tuesday, with on-chain investigators identifying transfers totaling around $175 million.

The movement came hours after Arbitrum froze a portion of the stolen assets, placing 30,766 ETH connected to the attack into an intermediary wallet that can only be accessed through Arbitrum governance. The freeze was one of the few successful containment steps since the exploit was disclosed over the weekend.