Arbitrum halts ETH transfers to contain fallout from KelpDAO hack

Arbitrum decided on an unprecedented move, freezing ETH to prevent further losses from the KelpDAO attack. The protocol may prevent some of the bad debt on its native version of Aave. 

Arbitrum has announced the freeze of 30,776 ETH held on Arbitrum One and traced it back to the KelpDAO. The tokens, valued at $71M, were not bridged back to Ethereum for mixing days after the hack, allowing Arbitrum a window of action. 

The chain’s Security Council decided to freeze the funds, as large hacks are becoming a burden for DeFi protocols. The funds were moved to a new secure wallet, not accessible to the hackers, and can only be released after a new governance decision by Arbitrum’s council. 

The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,…

— Arbitrum (@arbitrum) April 21, 2026

Arbitrum’s actions are one of the biggest freezes following a hack. The large losses in the past month raised the issue of freezing funds on time, despite the initial ethos of not censoring on-chain movements. Soon after the funds were frozen, the hacker started moving and mixing the remaining ETH, diminishing hopes of a recovery. 

The Security Council held a long discussion before deciding to act. In previous hacks, funds were rarely frozen, even by chains with the explicit right to blacklist wallets. In this case, Arbitrum decided to act and prevent bad debt contagion by reclaiming some of the lost ETH.

Arbitrum joins wider decision to freeze ETH

Arbitrum was the latest stage in a wider decision to contain the lost ETH and avoid DeFi contagion through bad debt. Aave immediately froze its two riskiest vaults to avoid more losses.

Aave has still frozen ETH on several networks where it has native vaults. 

Update on rsETH incident:

WETH reserves on the Ethereum Core V3 market have been unfrozen and users can supply WETH to Ethereum Core V3 again. WETH LTV remains at 0.

WETH reserves on Ethereum Prime, Arbitrum, Base, Mantle, and Linea remain frozen.

Aave service providers will…

— Aave (@aave) April 21, 2026

The latest estimate of $196M in bad debt may diminish if the protocols are able to intercept and freeze some of the funds. Arbitrum used a forced state transition, which did not require the address owner to sign the transaction to a new wallet.

The ability to move funds from wallets raises the issue of the censorship-free nature of crypto ownership. This time, the funds were taken from the wallet of a bad actor, setting a new potential standard for reacting to hacks. 

As Web3 attacks accelerated in Q1, protocols seek ways to quickly intercept funds and not rely on ad-hoc solutions. 

Following the hack, Arbitrum lost $300M in total value locked, down to $1.7B. Aave was down to $16.52B, down from around $25B before the hack.  

Arbitrum DAO saved its own funds

Arbitrum DAO managed to save its own funds and prevent some of the bad debt on the L2 chain. Arbitrum may be affected heavily, as rsETH may not be fully backed on the L2 chain, but only on the Ethereum main net. 

Arbitrum has managed to claw back around 25% of the stolen funds. Currently, KelpDAO and other affected parties are negotiating with Layer Zero to discover the main flaw point for the hack and a way forward to recover losses. 

The recent hack was more influential due to the composability of DeFi, leaving multiple protocols exposed to rsETH and destroying multiple positions based on token collateral.

Your bank is using your money. You’re getting the scraps. Watch our free video on becoming your own bank