Lazarus Group Suspected of Moving $175M in ETH After Arbitrum Freezes $71M From KelpDAO Exploit
21 Apr 2026 · 13:19 UTC · Bitcoin.com RSS Feed · Original source
Read original at Bitcoin.com RSS Feed →
Summary
North Korea's Lazarus Group is preliminarily attributed with draining approximately $292 million in rsETH from KelpDAO on April 18, 2026. The attack involved the group draining 116,500 rsETH tokens. Arbitrum has frozen $71 million of the stolen funds from the exploit. Lazarus Group is suspected of moving $175 million in ETH following the attack. The state-backed hacking entity has been responsible for billions of dollars in cryptocurrency theft over recent years. This incident represents one of the largest DeFi exploits and highlights ongoing security vulnerabilities within decentralized finance protocols.
Why it matters
Market impact mechanisms operate across distinct time horizons: (1) Immediate (minute-to-hour): News of a $292 million exploit triggers panic selling in affected protocols and neighboring DeFi tokens. Flight-to-safety effects drive capital toward Bitcoin, creating relative support. Peak fear occurs within the first few hours. (2) Short-term (daily-to-weekly): Preliminary attribution status creates information uncertainty; investors await confirmation while evaluating broader DeFi security implications. Selling pressure persists but stabilizes as the market absorbs the loss scale. Bitcoin's safe-haven status provides relative resilience. (3) Medium-term (weekly-to-monthly): Impact gradually moderates as market processes incident specifics, recovery efforts, and regulatory responses. Sentiment improves but remains cautious. Key uncertainties: (a) Whether frozen funds will be recovered (Arbitrum's $71M freeze provides some hope); (b) Regulatory overreaction versus proportionate response; (c) Cascading security audits or protocol shutdowns; (d) State-sponsored actor involvement elevating geopolitical concern above typical breaches. Confidence is moderate because DeFi sentiment responds to multiple concurrent factors beyond this incident, and macroeconomic conditions may override isolated event impact. Bitcoin's relative insulation from DeFi-specific risks explains lower impact probabilities and smaller directional effects compared to altcoins.
Expected impact
The KelpDAO exploit attributed to Lazarus Group creates significant negative sentiment in decentralized finance. The preliminary attribution to North Korea's state-backed hacking group amplifies both security and geopolitical concerns. The incident triggers immediate market reactions: (1) Flight from DeFi protocols to perceived safer assets, with Bitcoin potentially benefiting as a safe haven in the hour following disclosure; (2) Sharp selling pressure in altcoins and DeFi tokens as investors reassess protocol security risks; (3) Increased volatility across altcoin markets as traders process the $292 million loss; (4) Potential regulatory scrutiny given state-sponsored actor involvement; and (5) Broader market risk-off sentiment. The Arbitrum protocol's ability to freeze $71 million demonstrates responsiveness but also highlights centralized control concerns that may undermine confidence in DeFi decentralization narratives. Bitcoin's impact is expected to be modest as the incident disproportionately affects DeFi-focused investors, though general market sentiment may create temporary downward pressure. Altcoin markets experience more severe and prolonged pressure due to sensitivity to security incidents and regulatory risks. Market impact moderates over days and weeks as investors process incident details and await recovery efforts.