Kelp DAO hacker moves $175M ETH after rsETH bridge theft; Arbitrum freezes $71M

Kelp DAO hacker used a LayerZero-powered bridge exploit to steal 116,500 rsETH (about $292M, ~18% of circulating supply). After pausing key contracts, the attacker deposited the stolen rsETH as collateral on Aave V3 and borrowed around $196M in WETH, raising immediate Aave bad-debt risk. Arbitrum’s Security Council then froze 30,766 ETH (~$71M) into a governance-controlled intermediary wallet. However, on-chain monitoring (Arkham) shows the Kelp DAO hacker continued moving funds. Within hours, the attacker reportedly transferred all ~75,701 ETH (about $175M) to Ethereum mainnet and began laundering, with the freeze covering less than 30% of stolen ETH. Market impact followed quickly: Aave saw a reported $8.45B deposit outflow and AAVE fell close to 20%. rsETH also retraced from a $2B+ peak to roughly $1.3B after a failed recovery attempt, consistent with forced unwinds. The broader issue remains unresolved: LayerZero pointed to a “single-verifier” (1-of-1 DVN) design as a bridge failure risk, while Kelp DAO argued the setup matched LayerZero’s documented defaults and that the compromised validator stack was LayerZero infrastructure. For traders, the key risk is that the Kelp DAO hacker’s fast fund movement plus partial freeze coverage can intensify risk-off behavior around cross-protocol collateral, especially for restaking-linked assets like rsETH.