Griff Green: Unusual movements of restaked ETH signal illicit activity, Thorchain’s role in laundering funds, and the risks of smart contract exploitation | Unchained

Arbitrum Security Council's bold move to freeze $70 million highlights the ongoing battle against crypto theft.

Listen on Unchained

Share

Add us on Google by Editorial Team May. 13, 2026

Key takeaways

• Large movements of restaked ETH are unusual and may signal illicit activities.
• Thorchain is frequently used by criminal groups to launder funds.
• Exploiting smart contracts can lead to unintended consequences, such as creating bad debt.
• The Lazarus group exploited the restaked ETH system, causing significant financial losses for Aave.
• The incident raises philosophical questions about decentralization in finance.
• Failure modes in financial products arise when derivatives are created on top of pure assets like Ethereum.
• DeFi enables users to generate yield on their assets without a centralized middleman.
• Protocols must evaluate which projects and tokens are trustworthy to avoid exploits.
• Exploits occur when decentralized trust fails due to incorrect protocol logic.
• Users are monitoring deposit alerts to withdraw funds quickly in a bank run-like scenario.
• The DeFi ecosystem allows asset utilization without relying on centralized entities.
• Smart contract vulnerabilities highlight the need for rigorous auditing and evaluation.
• The interplay between decentralization and user safety is a critical issue in DeFi.
• Understanding the mechanics of smart contracts is crucial for identifying potential risks.
• The transformative potential of DeFi lies in its ability to empower users financially.

Guest intro

Griff Green serves as a member of the Arbitrum Security Council. He played a key role in the council’s decision to freeze $70 million in stolen funds linked to North Korean hackers following the KelpDAO exploit. His expertise in blockchain security and DAO governance informs the response to such high-stakes incidents.

The unusual movement of restaked ETH

• Large movements of restaked ETH are considered abnormal and suggest potential illicit activity.

• It’s extremely abnormal to have hundreds of millions of dollars of restaked ETH moving in a way that is not typical

  — Griff Green

• These transactions are not everyday occurrences, indicating a need for further investigation.
• Understanding typical ETH transaction behavior is crucial for blockchain monitoring.
• The unusual nature of these transactions suggests possible criminal activity.
• Large movements can disrupt the stability of DeFi protocols.
• Monitoring such transactions can help identify security threats.
• The significance of these movements lies in their potential impact on the DeFi ecosystem.

Thorchain’s role in illicit activities

• Thorchain is often used by criminal groups to launder funds.

• Thorchain in general has been seen as a chain of choice especially for North Korean groups

  — Griff Green

• The platform’s features make it attractive for making funds untraceable.
• Understanding blockchain network perceptions is essential for security assessments.
• Criminal groups exploit blockchain technology for laundering purposes.
• The use of Thorchain highlights the need for improved security measures.
• The platform’s reputation affects its use in legitimate transactions.
• Monitoring Thorchain activities can provide insights into illicit financial flows.

Smart contract exploitation and its consequences

• Exploiting smart contracts can lead to unintended outcomes like bad debt.

• Somebody figures out how to trick or exploit the logic

  — Griff Green

• These manipulations can disrupt DeFi protocols and affect users.
• Understanding smart contract mechanics is key to identifying vulnerabilities.
• Exploitation highlights the need for robust contract design and auditing.
• The risks associated with smart contracts are crucial for DeFi security.
• Manipulated contracts can have widespread effects on financial ecosystems.
• The potential for exploitation underscores the importance of continuous monitoring.

The Lazarus group’s impact on Aave

• The Lazarus group exploited the restaked ETH system, causing losses for Aave.

• The Lazarus group deposited $270,000,000 worth of this wrapped restaked ETH

  — Griff Green

• This incident illustrates the real-world implications of DeFi vulnerabilities.
• Knowledge of specific incidents helps in understanding protocol weaknesses.
• The exploitation resulted in significant financial losses and bad debt.
• Such incidents highlight the need for improved security measures in DeFi.
• The group’s actions demonstrate the risks posed by sophisticated attackers.
• Understanding these events is crucial for developing better defense strategies.

Philosophical questions about decentralization

• The incident raises questions about the nature of decentralization in finance.

• It sort of opens up a bunch of philosophical questions

  — Griff Green

• The balance between decentralization and user safety is a critical issue.
• Understanding these implications is key for future DeFi development.
• The tension between decentralization and control affects user trust.
• These questions influence the design and operation of DeFi products.
• Exploring these issues can lead to more resilient financial systems.
• The philosophical debate shapes the evolution of decentralized finance.

Risks in financial products and derivatives

• Failure modes arise when derivatives are created on top of pure assets.

• Where the failure modes happen is when we produce financial products

  — Griff Green

• Understanding the distinction between pure assets and derivatives is crucial.
• Financial products introduce risks not present in holding pure assets.
• The creation of yield-generating mechanisms can lead to vulnerabilities.
• These risks highlight the need for careful evaluation of financial products.
• The potential for failure underscores the importance of risk management.
• Understanding these dynamics is key to navigating the DeFi landscape.

The transformative potential of DeFi

• DeFi enables users to generate yield on their assets without a centralized middleman.

• That is kind of what has built the decentralized financial ecosystem

  — Griff Green

• The ecosystem empowers users to utilize their assets more effectively.
• Understanding DeFi mechanisms is essential for grasping its significance.
• The lack of a centralized middleman reduces costs and increases efficiency.
• DeFi’s potential lies in its ability to democratize financial services.
• The ecosystem’s growth is driven by user demand for decentralized solutions.
• Understanding these dynamics is crucial for participating in the DeFi space.

Evaluating trustworthiness in DeFi protocols

• Protocols must evaluate which projects and tokens are trustworthy.

• These protocols need to decide which protocols are real

  — Griff Green

• Due diligence is crucial for mitigating risks in decentralized finance.
• Understanding the importance of evaluation helps in protocol selection.
• Trustworthiness assessments can prevent exploits and financial losses.
• The evaluation process involves auditing and reviewing smart contract logic.
• Understanding these assessments is key for safe participation in DeFi.
• The decision-making process affects the security and stability of protocols.

The consequences of decentralized trust failures

• Exploits occur when decentralized trust fails due to incorrect assumptions.

• When your points of decentralized trust fail

  — Griff Green

• These failures highlight vulnerabilities in DeFi systems.
• Understanding decentralized trust is crucial for protocol security.
• Misplaced trust can lead to significant financial losses and exploits.
• The consequences of trust failures underscore the need for robust systems.
• Understanding these dynamics is key to improving DeFi resilience.
• The implications of trust failures affect user confidence in decentralized finance.

User behavior in liquidity challenges

• Users monitor deposit alerts to withdraw funds quickly in a bank run-like scenario.

• People are utilizing monitoring these contracts on these different platforms

  — Griff Green

• This behavior reflects user strategies during periods of instability.
• Understanding liquidity dynamics is crucial for navigating DeFi markets.
• Monitoring alerts helps users manage risks and protect their assets.
• The strategy highlights the importance of real-time information in DeFi.
• Understanding these behaviors is key for participating in decentralized finance.
• The dynamics of user behavior affect the stability and resilience of DeFi platforms.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.