Kelp DAO Exploiter Moves $175M ETH After Arbitrum Freeze — Liquidation Risk Mounts for Leveraged ETH Traders

Event Summary

According to PeckShieldAlert and Unchained Crypto, the attacker behind the April 18, 2026 Kelp DAO exploit — attributed preliminarily to North Korea's Lazarus Group by LayerZero — moved approximately 75,700 ETH (~$175M) into two new wallets hours after the Arbitrum Security Council froze 30,766 ETH (~$70–71M) on April 21. The original wallet was drained to 0.768 ETH, confirming a full exit. Transfers went to `0xF980…5910` (25,000 ETH, ~$57.93M) and `0xABc8…6FAD` (50,700 ETH, ~$117.48M).

The exploit itself targeted a LayerZero bridge vulnerability — a single-validator DVN setup — allowing the attacker to mint and drain 116,500 rsETH (~$292–293M, roughly 18% of circulating supply). Funds were laundered through Aave V3, Compound V3, and Oiler, generating ~$236M in borrowed clean ETH. The freeze recovered only ~25% of total stolen funds; the remaining $175M remains mobile and actively monitored by security teams.

Leverage Impact Analysis

With ~$175M in ETH now split across two unfrozen wallets, leveraged ETH longs face acute dump risk. Any conversion of these holdings to stablecoins or BTC could generate significant downside price pressure — a scenario that creates cascading liquidation risk for high-leverage perpetual positions.

Consider a concrete scenario: a trader holding a 50x long ETH perpetual opened near recent levels would see liquidation triggered by a relatively modest move lower — roughly 2% adverse movement at 50x erases the initial margin entirely. At 100x leverage, that threshold compresses to approximately 1%. Given that $175M represents meaningful ETH supply pressure, traders using high multiples should treat this as an elevated-volatility environment.

Funding rates and open interest should be monitored closely on CoinUnited.io — elevated long-side funding in this environment would signal crowded positioning vulnerable to forced unwinds. The DeFi Structural Reset theme remains active; DeFi-correlated assets like Aave face additional pressure given the ~$236M that was extracted through lending protocols, raising bad-debt concerns.

For Arbitrum (ARB), currently trading at $0.1259 (down 1.10% over 24 hours, with a 24h range of $0.1254–$0.1284), the freeze narrative offers limited support. The exploit exposed structural L2 bridge risks, and ecosystem outflows could continue to suppress ARB near its 24h low.

Cross-Market Impact

This event is largely crypto-specific but carries sentiment spillover into crypto-adjacent equities. Coinbase (COIN) and Robinhood (HOOD) are both exposed to broad crypto sentiment deterioration — a $292M DeFi hack attributed to a state-sponsored actor reinforces the regulatory scrutiny narrative covered in our state-sponsored crypto hacks guide. Tightening DeFi oversight could pressure exchange revenue expectations.

USDC flows are worth watching as a risk-off proxy within crypto — stablecoin inflows during this period may indicate capital rotating out of DeFi exposure. For broader macro assets (Gold, DXY), the impact is limited unless broader risk-off sentiment accelerates.

Trading Considerations

ARB is holding just above its 24h low of $0.1254 — a break below that level on volume would signal continued distribution pressure. Resistance sits at the 24h high of $0.1284. For ETH, the key watch is whether the two new attacker wallets initiate on-chain swaps or bridge activity, which security teams are actively tracking.

Risk management is critical here: position sizing should account for potential sudden volatility spikes if large ETH dumps begin. Monitor open interest changes on CoinUnited.io for confirmation of directional conviction before adding exposure.

Trade Arbitrum on CoinUnited.io

Trade ARB with up to 2000xx leverage → | Create Free Account