Arbitrum Secures $71 Million in Ether Linked to Kelp DAO Breach

A significant portion of the funds stolen from Kelp DAO has been immobilized. Arbitrum's Security Council took decisive action on Monday, freezing approximately $71 million worth of ether, which is roughly 30,766 ETH. This move was made in response to the $292 million rsETH exploit that occurred on Saturday. The frozen funds, which were linked to the breach, have been transferred to an intermediary wallet, and their access is now contingent upon further governance action by Arbitrum. rsETH is a token representing a user's position in restaked ether, issued by KelpDAO. The Security Council's swift action was taken with input from law enforcement, which had identified the exploiter. This emergency measure was executed without disrupting any Arbitrum users or applications. According to Arbitrum's statement, the transfer was completed at 11:26 p.m. ET on April 20, and the stolen funds are no longer under the control of the original address. This move has recovered about a quarter of the total amount that was drained from Kelp's LayerZero-powered bridge on Saturday, when attackers exploited compromised verifier infrastructure to steal 116,500 rsETH. LayerZero has attributed the attack to North Korea's Lazarus Group with preliminary confidence. As a layer-2 blockchain, Arbitrum processes transactions more cheaply and settles them back to the main chain. Its Security Council has the emergency powers to take protective action in such scenarios, although governance-level interventions on user funds are rare and controversial. The freeze provides Kelp with a partial recovery option, in addition to any other potential recoveries through law enforcement and chain-tracing firms. This development also escalates the ongoing dispute between Kelp and LayerZero over who bears responsibility for the exploit, as any broader socialization of remaining losses now has a $71 million offset. Kelp is coordinating with ecosystem partners on a recovery fund and considering next steps on unpausing, loss socialization, and legal coordination with affected counterparties. The possibility of freezing additional stolen funds depends on the attacker's movements of rsETH or its derivatives before consolidation and whether other chains with similar emergency powers choose to act.