Understanding crypto recovery scams: how they work and how to avoid falling into these fraudulent schemes.
Arbitrum froze over $71M in ETH linked to the Kelp exploit — a rare move at this scale in DeFi. At the same time, sanctioned Russian exchange Grinex halted trading after a hack, blaming “foreign intelligence services.”
On the surface, these look like security incidents. In practice, they’re case studies in how crypto crime moves, how enforcement is evolving, and where exposure quietly builds up.
Let’s break them down.
The Kelp Hack and the Arbitrum Freeze: What Actually Happened
On April 20, Arbitrum froze ETH worth about $71.2 million linked to the KelpDAO exploit. The move made headlines. But the freeze is just the entry point. To understand what this means for compliance teams, you have to start two days earlier.
KelpDAO hack
On April 18, 2026, attackers drained approximately 116,500 rsETH — worth around $292 million — from KelpDAO.
The LayerZero Kelp exploit targeted the cross-chain messaging layer, triggering the release of ~116,500 rsETH, which was about 18% of total supply. Hackers used the stolen rsETH as collateral across multiple platforms to borrow $236 million.
The precision of the attack was striking. According to our data, the first transaction occurred just 1 minute and 48 seconds after the exploit. The final move into the hacker's aggregation wallet followed 1 hour, 58 minutes, and 51 seconds later.
The stolen funds split across three chains:
Two days later: Arbitrum steps in
The Arbitrum Kelp exploit response came on April 20, when the Security Council moved 30,766 ETH (over $71 million) into a governance-controlled frozen wallet. Any further movement now requires a formal governance vote.
The Council acted in coordination with law enforcement and explicitly limited the freeze to stolen funds, without impacting other users or the broader chain state.
The freeze, however, didn't stop the attacker. Roughly four hours after the Arbitrum freeze, the hacker began moving the remaining funds on Ethereum. At the time of the publication, the money went to three hackers addresses, which have started splitting and laundering the funds:
KelpDAO exploit, hackers addresses. Source: Global Ledger
KelpDAO hackers & the Bybit hack
Global Ledger's on-chain tracing then identified that the KelpDAO hacker's wallet infrastructure overlaps with wallets used in the Bybit hack laundering — the ~$1.4 billion exploit widely attributed to North Korean attackers.
Specifically, we have traced the funds that were sent to Bitcoin network via THORChain: 16.13150026 ETH ($37,461.56 USD) was swapped into 0.48699566 BTC ($37,270.76) and sent to a wallet used in the Bybit hack laundering.
DPRK-linked groups are known to reuse self-hosted wallet infrastructure across different attacks — a pattern consistent with pre-planned, coordinated operations rather than an individual case. In 2025 across 255 incidents, DPRK-linked hackers were responsible for $1.89 billion in stolen assets (~46.8% of total losses).
Why this matters
- The Arbitrum freeze is a new precedent. Even after the Bybit hack, a network-level intervention was discussed but never executed. This time it happened — and it changes what "decentralized" means for enforcement.
- DPRK-linked hacks are a system, not isolated incidents. If funds connect to North Korean actors, any downstream interaction with those assets creates sanctions exposure — even an indirect one.
- Speed is still the gap. $292M moved across three chains in under 2 hours. According to Global Ledger research, in ~76% of 2025 hacks — 195 out of 255 cases — funds moved before the industry could even publicly report the incident.
How Global Ledger can support
When $292 million moves in two hours and laundering starts before most teams have read the news, the response window is measured in minutes, — not days.
With the Global Ledger KYT platform, you can:
The Kelp hack shows how fast on-chain enforcement can move and how quickly stolen funds can disappear across chains before anyone reacts. The next case shows a different kind of exposure: one that built up over months, sitting in plain sight inside a sanctioned exchange.
Sanctioned Russian Exchange Grinex Halted Trading After $19M Hack
On April 16, 2026, Grinex — a Russian crypto exchange operating under OFAC sanctions since August 2025 — announced it was halting all trading activity following a cyberattack.
The exchange claimed losses of approximately 1 billion Russian rubles (~$13.1 million) and attributed the Grinex hack to "foreign intelligence services". However, Global Ledger found no on-chain evidence supporting that attribution.
Our data shows that about $19.38 million was stolen from Grinex. The attack simultaneously drained both operational customer deposit wallets on the TRON network — meaning client funds were directly at risk, not just exchange reserves.
Three asset types were stolen in the same operation:
- A7A5 — a ruble-pegged A7A5 stablecoin tied to sanctioned Russian financial networks
- USDT — swapped to TRX via SunSwap DEX and consolidated
- TRX — consolidated in self-hosted wallets:
- TXK2U… holds 352,791,567 A7A5 (~$4.42 million)
- TH9kgj… holds 46,093,251 TRX (~$14.96 million)
The hack is significant. But the bigger compliance story is what the on-chain record of Grinex shows about the months leading up to it. From its launch over a year ago till the suspension, Grinex — a Garantex-linked exchange that emerged directly after the Garantex takedown — processed $16.54 billion worth of USDT and A7A5:
- $7.29 billion before OFAC sanctions (March 6 – August 14, 2025)
- $9.25 billion after sanctions (Aug 15, 2025 – April 15, 2026)
Grinex processed more sanctioned-era volume than pre-sanction volume. Activity declined after designation, but it never stopped, and the exchange continued to rely on top-tier licensed exchanges for its flows. Over the past two years, licensed entities processed approximately $13 billion in sanctioned funds, including Russian-origin flows.
Why this matters
- Exposure starts before sanctions and continues after. Grinex processed $9.25 billion after its OFAC designation, more than it did before. Flows don't stop when a designation is issued. If your institution or counterparties ‘touched’ this network at any point, the exposure may already be there.
- Strict liability still applies. Under OFAC rules, processing sanctioned funds unknowingly is not a defense but a potential violation.
- A7A5 poses a risk. The token is structurally tied to sanctioned Russian financial infrastructure and was specifically designed to move ruble liquidity around restrictions. Any interaction with A7A5 flows warrants enhanced due diligence, regardless of how many hops away it sits.
How Global Ledger can support
Grinex-type exposure doesn't always show up in direct transactions. It can sit two, three, or five hops away. For regulators, the depth doesn't reduce the risk. That's why understanding your full counterparty picture matters as much as monitoring individual transactions.
With the Global Ledger platform, you can:
FAQ
