Kelp DAO Hacker Just Moved $175 Million In Ethereum And Started Laundering It – Here Is What We Know

One of DeFi’s largest exploits in recent memory took a new turn on Tuesday as Arbitrum’s Security Council moved to freeze $71 million of the stolen funds — and the attacker responded almost immediately.

The incident began when an unknown attacker exploited a vulnerability in Kelp DAO’s LayerZero-powered bridge, draining 116,500 rsETH — approximately $292 million and roughly 18% of the token’s entire circulating supply. The scale of the theft triggered an emergency pause of Kelp DAO’s core contracts, but by then the damage was already done.

The stolen rsETH was subsequently deposited as collateral on Aave V3, where it was used to borrow approximately $196 million in wrapped ether, leaving Aave carrying bad debt it had no role in creating and setting off the confidence crisis that has defined the past week in DeFi.

Arbitrum’s Security Council acted by freezing 30,766 ETH — worth approximately $71 million at current prices — and moving the funds into a governance-controlled wallet. It was a meaningful intervention, executed quickly by blockchain standards.

The attacker did not wait to see what came next. Within hours of Arbitrum’s move, the hacker began reacting — a development that suggests the stolen funds are already in motion and that the window for on-chain recovery may be narrowing faster than the response can keep pace with.

$175 Million Is Already Moving — and the Debate It Leaves Behind Is Just Beginning

Arkham data confirms what many feared once Arbitrum acted. The Kelp DAO hacker has already moved all 75,701 ETH — approximately $175 million — on Ethereum and has begun laundering the funds. The Arbitrum freeze succeeded in capturing $71 million. The remaining $175 million, the larger share by a considerable margin, is now in motion and being actively obscured.

The arithmetic is stark. A coordinated intervention by one of DeFi’s most capable security councils froze less than 30% of the stolen funds. The rest left anyway.

That outcome has ignited a debate that extends well beyond Kelp DAO and Aave. Arbitrum’s ability to freeze wallet addresses — even in response to a clear theft — has prompted immediate questions about what blockchain immutability actually means in practice, and who holds the authority to override it. For some, the freeze represents responsible crisis response from a mature ecosystem defending its users. For others, it represents precisely the kind of centralized intervention that decentralized infrastructure was designed to prevent.

Both arguments are being made loudly, and neither is entirely wrong.

What is not in dispute is the damage this attack has inflicted on DeFi’s broader credibility. The Kelp DAO exploit exposed collateral risk in lending protocols, triggered an $8.45 billion deposit exodus from Aave, sent AAVE down nearly 20%, and has now produced a philosophical confrontation about the limits of decentralization at the worst possible moment — when the ecosystem most needs to project confidence.

rsETH Market Cap Reflects Instability in Kelp DAO’s Restaking Layer

The market cap of rsETH — the liquid restaking token issued by Kelp DAO — is currently hovering near $1.3 billion after a sharp contraction that disrupted its prior recovery structure. The chart shows that rsETH reached peaks above $2 billion during earlier phases, but has since entered a volatile, downward-adjusting range, reflecting stress within the restaking ecosystem rather than organic market cycles.

The most recent move is particularly notable. After a brief recovery toward the $1.6 billion region, the market cap was rejected and fell aggressively back toward the $1.3 billion level. This type of rapid expansion followed by equally sharp contraction typically signals forced unwinds rather than discretionary capital rotation. In this context, that aligns with the exploit involving Kelp DAO’s rsETH bridge, which introduced systemic uncertainty around the asset.

From a structural perspective, rsETH is now trading below its key moving averages, with the 200-day trend flattening and beginning to roll over. That suggests the growth phase that defined its earlier expansion has stalled, at least temporarily.

Because rsETH represents collateral within broader DeFi systems — including lending protocols — its market cap is not just a valuation metric, but a proxy for trust. The current compression indicates that confidence has weakened, and until stability returns, the restaking layer remains vulnerable to further volatility.

Featured image from ChatGPT, chart from TradingView.com