Arbitrum Security Council Freezes $71 Million in Ether Linked to Kelp DAO Exploit

Following the significant Kelp DAO exploit, a substantial portion of the stolen funds has been immobilized. On Monday, Arbitrum's Security Council successfully froze roughly $71 million worth of ether, transferring 30,766 ETH into a specially designated wallet that can only be accessed through additional governance procedures. This action was taken in response to the $292 million rsETH exploit that occurred on Saturday. rsETH is a unique token representing a user's stake in restaked ether. The Security Council, acting on information provided by law enforcement regarding the exploiter's identity, executed this freeze without disrupting any Arbitrum users or applications. The transfer was completed at 11:26 p.m. ET on April 20, as announced by Arbitrum. This move has effectively recovered about a quarter of the total amount drained from Kelp's LayerZero-powered bridge during the exploit, where attackers managed to pull 116,500 rsETH by exploiting vulnerabilities in the verifier infrastructure. Arbitrum, a layer-2 blockchain built on top of Ethereum, offers cheaper and faster transaction processing. Its Security Council possesses emergency powers to intervene in such scenarios, although such interventions on user funds are rare and can be controversial due to the discretionary control they introduce. The freeze provides Kelp with a partial recovery option, in addition to any potential recoveries by law enforcement and chain-tracing firms. It also raises questions about the ongoing dispute between Kelp and LayerZero regarding responsibility for the exploit, as the $71 million offset could impact how losses are socialized and addressed through legal means, insurance, or treasury contributions. Kelp is currently coordinating with ecosystem partners on a recovery fund and evaluating next steps, including unpausing, loss socialization, and legal coordination with affected parties. The potential for freezing additional stolen funds depends on the attacker's movements of rsETH or its derivatives and whether other chains will take similar action.