anyone know how to fix this my txns been stuck since yesterday
txns hash: 7ff661be760add29946d0c15b586980ba854989d8e493f2044c706c0dc902207
@octra@0xio_xyz
aave: yo arbitrum, send back the $71m you get from the hacker, we need it
arbitrum: chill, we’re voting on it, you’ll have it in a few days. defi united, remember?
aave: bet. love that for us
(suddenly, american lawyers show up)
plaintiffs: stop right there. that $71m is ours now
aave: excuse me??
plaintiffs: we have old judgments against north korea. the hacker was lazarus group. lazarus is north korea. therefore the funds belong to north korea. therefore we seize them
aave: wait. do you have proof it was north korea?
plaintiffs: yeah, tweets
aave: …tweets
plaintiffs: and a news article
aave: but even if it was them, holding stolen funds for 5 minutes doesn’t make you the owner??
plaintiffs: yes it does
aave: so if i smash a tiffany’s window, grab a diamond, and a bystander grabs it back from me, your creditor friends can seize the diamond?
plaintiffs: correct
arbitrum: uhh… what are we supposed to do here
plaintiffs: don’t move. everything’s frozen
aave: but the funds belong to my innocent users??
plaintiffs: not our problem
aave: if i lose this, nobody will ever stop a hacker again. why would they? the reward becomes a legal war with the thief’s creditors
plaintiffs: not our problem
aave: and sanctioned states will have an incentive to hack more, since stolen funds can pay off their old debts
plaintiffs: still not our problem
aave: (turns to the judge) your honor, either vacate this now, or make them post a $300m bond. we have days before the entire defi ecosystem cascades
judge: (tbd)
KelpDAO's $300M Hack - 89% covered by DeFi United
After the April 18 exploit drained $292M from @KelpDAO's LayerZero bridge (Lazarus Group's TraderTraitor suspected), the crypto industry came together instead of walking away.
Current commitments:
• @arbitrum - 30.7K ETH ($71.5M)
• @Mantle_Official - 30K ETH ($69.8M)
• @aave - 15K ETH ($34.9M)
• @ether_fi - 5K ETH ($11.6M)
• @StaniKulechov - 5K ETH ($11.6M)
• @LayerZero_Core - 5K ETH ($11.6M)
• @inkonchain - 5K ETH ($11.6M)
• @LidoFinance - 2.5K ETH ($5.82M)
• @ethena - 1K ETH ($2.33M)
• @golemproject - 1K ETH ($2.33M)
DeFi United - a coalition led by Aave and @StaniKulechov already has 100,200 $ETH committed out of 112,000 $ETH needed. Only 11,800 $ETH left to close the hole.
Inspired by @RR2Capital
There's 99,410 ETH in bad debt from the KelpDao exploit.
The good news? DeFi protocols have united with donations, and 90% is covered so far.
Here's a list of who's contributing:
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, weighed its commitment to the security and integrity of the Arbitrum community without impacting any Arbitrum users or applications.
After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users.
As of April 20 11:26pm ET the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action by Arbitrum governance, which will be coordinated with relevant parties.
the kelp rsETH post-mortem is wild
lazarus (dprk) compromised two rpc nodes that layerzero dvn was relying on. swapped the op-geth binaries. wrote a custom payload that forged messages *only when the dvn queried* - every other IP, including monitoring, saw clean truthful data.
then they DDoS'd the healthy RPCs to force failover onto the poisoned ones. drained $290M. self-destructed the malicious binaries to erase tracks.
they targeted rsETH because kelp ran a 1-of-1 DVN config with layerzero as sole verifier