Arbitrum Security Council Freezes $71 Million in Ether Linked to Kelp DAO Breach

A significant portion of the funds stolen from Kelp DAO has been immobilized. On Monday, Arbitrum's Security Council took swift action, freezing approximately $71 million worth of ether (30,766 ETH) linked to Saturday's massive $292 million rsETH exploit. This move transferred the compromised funds to an intermediary wallet, which can only be accessed via additional Arbitrum governance procedures. The rsETH token, issued by KelpDAO, represents a user's stake in restaked ether. In response to the exploit, the Arbitrum Security Council collaborated with law enforcement to identify the perpetrator and executed the freeze without disrupting any users or applications on the network. This proactive measure was taken at 11:26 p.m. ET on April 20, as announced by Arbitrum on X. As a result, the stolen funds are no longer under the control of the original address. This freeze recovers about a quarter of the total amount drained from Kelp's LayerZero-powered bridge on Saturday, when attackers exploited compromised verifier infrastructure to pull 116,500 rsETH. Preliminary findings suggest that North Korea's Lazarus Group was behind the attack. Arbitrum, a layer-2 blockchain built on top of Ethereum, offers cheaper and faster transaction processing, with its Security Council possessing emergency powers to intervene in such situations. However, governance-level interventions on user funds are rare and contentious, as they introduce a degree of discretionary control over an otherwise permissionless network. The freeze provides Kelp with a partial recovery option, in addition to any further recoveries that law enforcement and chain-tracing firms may achieve. This development also escalates the ongoing dispute between Kelp and LayerZero regarding responsibility for the exploit, as any broader socialization of remaining losses now has a $71 million offset. Kelp is currently coordinating with ecosystem partners on a recovery fund and exploring next steps, including unpausing, loss socialization, and legal coordination with affected counterparties. The potential for freezing additional stolen funds depends on the attacker's subsequent actions and whether other chains with similar emergency powers choose to act.