Certik Analyst: KelpDAO Exploit Reveals High-Stakes Shift in Cross-Chain Cybercrime

Key Takeaways:

• The Arbitrum Security Council and SEAL 911 froze 30,766 ETH on April 18 to mitigate the Kelp DAO heist.
• Certik analyst Wenzhao Dong warns that bridge thefts now create systemic bad debt for platforms like Aave.
• Kelp DAO aims to restore the rsETH peg and recover the remaining $220 million in missing digital assets.

Security vs. Sovereignty

The Arbitrum Security Council’s (ASC) swift intervention to freeze 30,766 ETH has reignited one of the most fundamental debates in blockchain: the tension between immutable decentralization and pragmatic governance.

While the recovery of $71 million in ETH is a clear victory for victims, the method has split the community into two distinct camps. On one hand, purists argue that the ASC’s ability to unilaterally freeze assets is a “slippery slope” toward the centralized financial systems cryptocurrency was designed to replace. They contend that if a council can censor a hacker today, it could be coerced into censoring a political dissident or a legal business tomorrow. To this group, “human-in-the-loop” intervention is a systemic vulnerability that undermines the core promise of trustlessness.

On the other hand, pragmatists view absolute decentralization as an aspirational end-state rather than a day-one requirement. They contend that for decentralized finance ( DeFi) to achieve mainstream adoption, it must have “circuit breakers” to mitigate catastrophic losses. From this perspective, the ASC is a necessary safeguard—a “digital fire department”—providing the accountability required to protect users from sophisticated state-sponsored actors like the Lazarus Group.

As reported by Bitcoin.com News and other media outlets, the ASC acted on input from law enforcement regarding the exploiter’s identity. The council stated it weighed its commitment to the security and integrity of the Arbitrum community while ensuring no impact on Arbitrum users or applications.

While the freeze provides temporary relief, one expert warned that the heist represents a new, more dangerous phase of DeFi crime where bridge vulnerabilities are systematically used to infect lending markets.

Providing a post-mortem on the attacker’s strategy, Wenzhao Dong, a blockchain analyst at Certik, pointed out that the North Korea-backed Lazarus Group displayed a sophisticated understanding of market liquidity. Dong noted that, unlike the recent Hyperbridge incident — where attackers minted 1 billion Polkadot but only managed to convert about $240,000 before the price crashed — the Kelp DAO attackers chose a more efficient “cash-out” route.

“The Kelp DAO exploit shows a clear risk pattern in modern DeFi,” Dong said. “A bridge vulnerability doesn’t stay isolated; it turns into a problem for lending markets. By using falsely minted rsETH as collateral on Aave to borrow WETH, the attacker changed a bridge theft into Aave bad debt.”

Dong noted that the attackers deliberately avoided spot markets, where massive sell orders would have triggered slippage and early detection. Instead, by using Aave as a middleman, they offloaded the risk onto the lending protocol.

“ DeFi security is interconnected,” Dong added. “Protocols cannot focus solely on their own contracts; they must consider the risks posed by every dependency in their system and implement defensive measures accordingly.”

In an update shared hours after the ASC announced the freeze, Kelp DAO expressed gratitude for the “decisive action” taken by the council. It credited SEAL 911’s “coordination and information structuring” as the key factor that allowed stakeholders to act before the hackers could move the remaining $71 million in ETH off the Arbitrum network.

Despite the successful freeze, approximately $220 million remains missing. Kelp DAO confirmed its primary focus is now working with Aave and other partners to address the “bad debt” created by the exploit. The organization stated it will also pursue all available avenues to support rsETH holders and restore the protocol’s peg.