Ethereum’s Split Screen: A $292 Million Heist and a 10,000 TPS Ambition

North Korean Lazarus Group steals $292M from Kelp DAO; DeFi United raises $161M in bailout. Ethereum's Glamsterdam upgrade targets 10,000 TPS by 2026.

The world’s second-largest blockchain is living a double life. On one side, a coordinated DeFi rescue mission is scrambling to contain the biggest hack of the year. On the other, developers are plotting a core architecture overhaul that could push transaction speeds into five figures. Ethereum’s price, meanwhile, is stuck in the middle.

The Lazarus Heist and a Historic Bailout

North Korean hackers struck on April 18, making off with 116,500 rsETH from Kelp DAO’s infrastructure — worth roughly $292 million. Chainalysis pinned the attack on the Lazarus Group, which manipulated external data feeds to bypass the system’s defenses. The theft ranks as the largest DeFi exploit of 2025 so far.

The response was anything but routine. Service providers tied to the Aave protocol launched “DeFi United,” a rescue fund aiming to raise 100,000 ETH to cover user losses. By April 24, the pot had already swelled to $161 million. Arbitrum added another layer of defense, freezing the stolen assets under emergency powers. Its decentralized governance now faces a vote on whether to release those funds directly to the relief effort.

The coordinated reaction marks a departure from DeFi’s usual playbook. In past attacks, protocols typically fought alone. This time, multiple independent networks moved in lockstep — a model that could reshape how the sector handles future crises.

Glamsterdam’s Architectural Pivot

While the hack dominated headlines, Ethereum’s developers were quietly advancing a far more structural transformation. The “Glamsterdam” upgrade, slated for the first half of 2026, targets the network’s base layer directly. Its headline goal: 10,000 transactions per second.

The key change involves splitting block producers and validators within the protocol’s own code. Currently, external intermediaries handle nearly 90% of that work, creating centralization risks. By baking the separation into the core software, Glamsterdam eliminates those middlemen entirely. For institutional users, the payoff is more predictable, auditable operations — and likely far lower fees.

A second upgrade, “Hegotá,” is already penciled in for late 2026. It aims to slash storage requirements for network nodes. Together, the two updates represent Ethereum’s most consequential infrastructure cycle since The Merge. Glamsterdam entered rigorous testing on developer networks in April, with trials on the Holesky and Sepolia testnets to follow in the coming months.

Institutional Cash Meets Weak On-Chain Demand

The market’s reaction to all this activity has been muted. Ether trades around $2,330, down roughly 22% since January. The 200-day moving average remains a distant target. On-chain metrics tell a similar story: weekly revenue from Ethereum applications has halved to $13 million over the past six months, while total value locked in DeFi protocols has dropped 27% since the start of the year.

Yet institutional money is flowing in from a different direction. US spot ETFs have logged ten consecutive days of net inflows, collecting $633 million — the longest demand streak since late 2024. BlackRock’s fund alone pulled in over $32 million on a single April trading day, even as some competitors saw light outflows.

Supply dynamics are tightening, too. Glassnode data shows investors withdrew 1.4 million ETH from exchanges over the past month, shifting holdings into cold storage. Nearly 39 million ether — roughly a third of the total supply — is now locked in staking contracts. That reduces immediate selling pressure, even if the price hasn’t yet reflected it.

A Precedent in the Making

The Arbitrum vote on the frozen hack proceeds will set a significant legal and operational precedent for DeFi. If approved, the funds will flow directly to the DeFi United rescue pool, effectively turning a coordinated emergency response into a permanent crisis tool.

For now, Ethereum’s narrative is fractured: a network racing to upgrade its core while cleaning up after a record exploit, all while its token trades at a discount to its start-of-year level. The Glamsterdam test results and the Arbitrum governance decision will each offer a clue about which side of that split screen ultimately wins out.