Arbitrum Pretends to Be the Hacker, 'Steals' Back the Money Lost by KelpDAO

marsbitPublicado em 2026-04-21Última atualização em 2026-04-21

Resumo

Title: Arbitrum Poses as Hacker to Recover Stolen Funds from KelpDAO Last week, KelpDAO suffered a hack resulting in nearly $300 million in losses, marking the largest DeFi security incident this year. Approximately 30,765 ETH (worth over $70 million) remained on an Arbitrum address controlled by the attacker. In an unprecedented move, Arbitrum’s Security Council utilized its emergency authority to upgrade the Inbox bridge contract, adding a function that allowed them to impersonate the hacker’s address and initiate a transfer without access to its private key. The council’s action, approved by 9 of its 12 members, moved the stolen ETH to a frozen address in a single transaction before reverting the contract to its original state. The operation was coordinated with law enforcement, which attributed the attack to North Korea’s Lazarus Group. Community reactions are divided: some praise the recovery of funds, while others question the centralization of power, as the council can upgrade core contracts without governance votes. However, such emergency mechanisms are common among major L2s. Despite the partial recovery, over $292 million was stolen in total, with more than $100 million in bad debt on Aave and remaining funds scattered across other chains. The incident highlights escalating security challenges in DeFi, with state-sponsored hackers employing advanced tactics and L2s responding with elevated countermeasures.

Author: Deep Tide TechFlow

Last week, KelpDAO was hacked for nearly $300 million, making it the largest negative security incident in DeFi so far this year.

The stolen ETH is now scattered across multiple chains, with approximately 30,765 ETH remaining in an address on the Arbitrum chain, worth over $70 million.

Just when everyone thought the story was over, a sequel emerged today.

According to on-chain security firm PeckShield, the funds in the hacker's address on the Arbitrum chain were transferred out a few hours ago. Strangely, the funds were moved to a bizarre address that appears to be almost all zeros: 0x00000...

Everyone was speculating: Did the hacker burn the funds by sending them to a black hole address? Or did they have a change of heart or get recruited?

Neither.

A few hours ago, the Arbitrum official forum posted an emergency action announcement explaining the situation. The hacker's funds were transferred by the Arbitrum Security Council.

However, the remarkable part is that without knowing the private key of the hacker's address, the Arbitrum Council neither froze the funds nor had the authority to transfer them. Instead, they directly issued a transfer instruction "in the name of the hacker."

The hacker was unaware, the private key was not leaked, and the on-chain records made it look like the hacker had performed the operation themselves.

The principle behind this operation is that all cross-chain messages between Arbitrum and Ethereum must pass through a bridge contract called Inbox. The Security Council used its emergency authority to temporarily upgrade this contract, adding a new function:

It allows sending cross-chain transactions in the name of any wallet address, without needing that wallet's private key.

They then used this function to forge a message, with the sender field filled as the hacker's wallet, and the content being "Transfer all my ETH to the frozen address." The Arbitrum chain received it and executed it as usual, resulting in the bizarre scene captured in the on-chain transfer screenshot above.

After transferring the hacker's funds, the contract was immediately downgraded back to its original version. The upgrade, forgery, transfer, and restoration were all completed within a single Ethereum transaction. Other users and applications were completely unaffected.

This operation is unprecedented in Arbitrum's history.

According to the forum announcement, the Security Council first confirmed the hacker's identity with law enforcement, pointing to North Korea's Lazarus Group, the most active state-level hacker organization in the DeFi space this year. The council conducted a technical assessment to ensure it would not affect other users before taking action.

Since the hacker was in the wrong first, this move carries a bit of a "don't blame us for not playing by the rules" sentiment. As for the subsequent handling of the frozen ETH, it will go through Arbitrum's DAO governance vote and be coordinated with law enforcement.

Recovering over $70 million in stolen funds is undoubtedly a good thing. But it's worth noting the prerequisite for achieving this: 9 out of the 12 members of the Security Council can sign to bypass all governance votes and upgrade any core on-chain contract with zero delay.

Praising the Outcome, Worrying about the Capability?

Currently, the community's reaction is divided.

Some think Arbitrum did a great job, protecting assets at a critical moment, which actually adds a bit of confidence in L2. Others ask a very direct question: If 9 people can sign to move any asset in anyone's name, can this still be called decentralization?

In my opinion, the two sides are actually talking about different things.

The former is talking about the result, the latter is talking about the capability. The result of this incident is certainly good—over $70 million in stolen funds was recovered. But the capability demonstrated by Arbitrum this time—to modify contract functions via multi-sig—is neutral in itself; what it is used for in the future, whether it can be used, and how it is used, all actually depend on the council's governance.

However, for most people using Arbitrum, this discussion might be less relevant than another fact. Arbitrum is not special; currently, almost all mainstream L2s retain similar emergency upgrade permissions.

The chain you are using most likely also has a similar Security Council with similar capabilities. This is not a unique choice by Arbitrum; it's almost a universal design for L2s at this stage.

Looking at it from another angle, this offensive and defensive battle actually reveals a bigger picture.

The attacker is North Korea's Lazarus Group, attributed to at least 18 DeFi attacks since the beginning of this year. Just three weeks ago, they stole $285 million from Drift Protocol using a completely different method.

On one side, state-level hackers are constantly upgrading their attack methods; on the other, L2s are starting to use underlying permissions to fight back. The security war in DeFi is entering a new stage, moving beyond "post-incident freezes, on-chain shouting, and praying for white hats to intervene."

In extraordinary times, they created a master key to open the hacker's address, and melted the key after use. Just judging by this incident alone, having the capability to respond to hacker attacks is not a bad thing.

And if we must elevate this to a philosophical discussion about "this is not decentralized at all," then there are many more things to talk about. The crypto industry has no shortage of centralized operations. This time, at least, it was handling a negative incident and solving a problem, not creating one.

Looking back more pragmatically, KelpDAO was robbed of $292 million, and only over $70 million was recovered—less than a quarter of the total. The remaining ETH is still scattered on other chains. Over $100 million in bad debt on Aave remains unresolved, and it's still unknown how much rsETH holders will get back.

Even though Arbitrum invoked god-like permissions, this battle is clearly far from over.

Perguntas relacionadas

QWhat was the approximate value of the ETH stolen from KelpDAO that remained on the Arbitrum chain?

AOver $70 million worth of ETH, specifically 30,765 ETH, remained on the Arbitrum chain.

QHow did the Arbitrum Security Council manage to move the hacker's funds without the private key?

AThe Security Council used its emergency powers to temporarily upgrade the Inbox bridge contract, adding a new function that allowed them to forge a cross-chain message that appeared to be from the hacker's address, instructing the transfer of all ETH to a frozen address.

QWhich hacker organization was identified as being responsible for the attack on KelpDAO?

AThe attack was attributed to the North Korean state-backed hacker group, Lazarus Group.

QWhat is a major concern raised by the community regarding the Arbitrum Security Council's action?

AA major concern is that the action demonstrates a lack of decentralization, as 9 out of 12 council members can sign to upgrade any core contract and move any assets without a governance vote.

QWhat percentage of the total stolen funds from KelpDAO was recovered through this action on Arbitrum?

ALess than a quarter of the total stolen funds were recovered. The action recovered roughly $70 million of the total $292 million stolen.

Leituras Relacionadas

Annual Salary of Millions Competing for Electricians, Meta Rushes to Open Its Own Technical School

The AI boom is facing an unexpected bottleneck: a severe shortage of skilled construction workers and electricians. As tech giants like Meta, OpenAI, and Alphabet race to build massive data centers—such as OpenAI's $16 billion "Stargate" project—they are hitting a critical labor wall. The U.S. needs an estimated 130,000 more electricians, 240,000 construction workers, and 150,000 supervisors by 2030 for AI infrastructure alone, but tens of thousands of electrician jobs go unfilled each year. While AI companies offer high premiums, with electricians earning up to $280,000 annually, worker scarcity still causes massive losses—delays on a single project can cost $14.2 million per month. The complexity of building AI data centers, which require immense power (equivalent to powering hundreds of thousands of homes), sophisticated electrical systems, and advanced liquid cooling solutions, demands highly skilled technicians who are in short supply. To combat this, companies are investing heavily in training. Meta has committed $115 million to a free training school offering tuition, housing, and stipends, targeting 5,000 new workers. OpenAI is partnering with unions to secure skilled labor. These efforts are paying off, with a significant rise in Gen Z interest in trade schools over college. However, the power demands are staggering. AI data centers are driving a rapid surge in electricity consumption, projected to account for up to 12% of U.S. power use by 2028 and raising costs for consumers. Furthermore, the construction boom is project-based, leading to a potential future glut of trained workers once building peaks, which could depress wages industry-wide. The race for AI supremacy now depends as much on skilled hands as on advanced chips.

marsbitHá 9m

Annual Salary of Millions Competing for Electricians, Meta Rushes to Open Its Own Technical School

marsbitHá 9m

OpenAI No Longer Sells Its Most Expensive Model for Profit

OpenAI is shifting its business strategy away from promoting its most expensive, flagship models for every task. Recent price cuts—80% for GPT-5.6 Luna and 20% for Terra—signal a deeper change: the company now actively advises users that many tasks don't require the most powerful model. Instead, OpenAI recommends a tiered approach: use the high-end GPT-5.6 Sol for complex planning and analysis, then delegate execution to cheaper models like Luna. This mirrors moves by Anthropic, which recently launched Claude Opus 5 at half the price of its top model, Fable 5. Both companies are de-emphasizing flagship models as primary revenue drivers, using them instead for brand prestige and technological showcases. The industry is entering a "mass-market" phase, similar to automotive, where high-volume, cost-effective models handle daily operations and drive scale. OpenAI's price reductions are partly enabled by AI models themselves optimizing underlying code and infrastructure, creating a self-reinforcing cycle of efficiency gains and cost reduction. Competition is shifting from "who is smartest" to "who offers the best value." The goal is no longer selling individual models but fostering widespread API adoption and ecosystem lock-in. By making AI calls cheap and ubiquitous, companies like OpenAI aim to become the indispensable, utility-like infrastructure powering automated workflows—the "water and electricity" of software, quietly embedded everywhere.

marsbitHá 9m

OpenAI No Longer Sells Its Most Expensive Model for Profit

marsbitHá 9m

Suspected 4th Coldcard attack wave sweeps 389 Bitcoin: Galaxy’s Thorn

Coldcard hardware wallet users are facing a new wave of coordinated attacks targeting a firmware flaw, with researcher Alex Thorn flagging 218 recent transactions moving approximately 389 Bitcoin from potentially impacted addresses. The attack pattern shows a high rate of transactions targeting unique victim addresses, differing from previous waves. The vulnerability, which causes affected devices to generate weaker wallet seeds, is estimated to have impacted over 1,100 wallets, leading to around $90 million in Bitcoin stolen. Thorn advises affected users who control their keys may attempt to move funds with a higher-fee transaction before the attacker's transactions are confirmed.

cointelegraphHá 16m

Suspected 4th Coldcard attack wave sweeps 389 Bitcoin: Galaxy’s Thorn

cointelegraphHá 16m

Bitcoin Miners Are Waving the White Flag, But Their Stocks Are Soaring

Bitcoin miners are capitulating as evidenced by a sustained drop in network hash rate and a record-steep 19.9% decline in mining difficulty, signaling the shuttering of unprofitable machines. However, in a significant divergence from historical patterns, the stocks of publicly traded mining companies have soared, with one major player gaining over 430% in the past year, even as BTC's price fell roughly 46%. This surge is largely attributed to these companies pivoting toward the more lucrative AI narrative. Simultaneously, miners face a structural squeeze. Daily block reward revenue in BTC terms has hit a new all-time low following the latest halving, with current dollar-denominated daily revenue around $30 million compared to a longer-term average of ~$40 million. Fee revenue remains negligible, covering less than one block's subsidy over a 28-day average and accounting for only about ten minutes of the network's daily security budget. This capitulation cycle is unique: miner stress and crypto price weakness have decoupled due to alternative revenue streams (AI), while the long-term reliance on increasing bitcoin prices to offset shrinking subsidies continues, with fee income still far from filling the impending gap.

marsbitHá 19m

Bitcoin Miners Are Waving the White Flag, But Their Stocks Are Soaring

marsbitHá 19m

Will the Fed Definitely Raise Interest Rates in September? How Will Crypto and U.S. Stocks Withstand the Pressure?

The market's expectation for a September Fed rate hike surged dramatically in early August, jumping from under 50% to over 80% within a week. This shift followed a contentious July FOMC meeting, where a 9-3 vote to hold rates revealed growing dissent from hawkish members advocating for an immediate hike to combat persistent inflation. The primary catalyst for this repricing is rising oil prices, driven by renewed geopolitical tensions around the Strait of Hormuz, which threaten global supply. Energy costs directly influence inflation metrics, making the upcoming July CPI report (due August 12th) a critical data point. If it shows inflation reaccelerating, the probability of a September hike will solidify. For Bitcoin and crypto assets, this is typically bearish news. Bitcoin continues to behave as a high-beta, liquidity-sensitive risk asset. A rate hike raises the opportunity cost of holding non-yielding assets and could drive capital toward money markets, pressuring crypto prices in the short term. However, historical patterns suggest that if a hike is perceived as the end of a tightening cycle rather than the start, any negative price impact may be brief. U.S. stocks, particularly crypto-linked equities like Coinbase and growth-oriented tech stocks, are also vulnerable. Higher rates increase discount rates in valuation models, putting pressure on high-multiple companies. This coincides with a pivotal tech earnings season where investor focus has shifted from massive AI capital expenditure to tangible revenue and cash flow generation. Companies with negative cash flow and weak growth narratives could face heightened volatility if borrowing costs rise in September. In summary, a September Fed hike has evolved into a mainstream market scenario. Key factors to watch are oil prices, the July CPI report, and Fed communications, which will determine the final decision and its impact on volatile crypto and equity markets.

marsbitHá 19m