Arbitrum Secures $71 Million in Ether Linked to Kelp DAO Exploit

A significant portion of the Kelp DAO funds is now inaccessible. Arbitrum's Security Council has frozen approximately $71 million worth of ether, moving 30,766 ETH linked to the $292 million rsETH exploit into a secure intermediary wallet. This wallet can only be accessed through additional Arbitrum governance measures. The frozen funds are part of the $292 million stolen from Kelp DAO's liquid restaking token, rsETH, which represents a user's position in restaked ether. The Arbitrum Security Council took emergency action to freeze the funds, acting on input from law enforcement regarding the exploiter's identity. The council executed the freeze without impacting any Arbitrum users or applications. The transfer was completed on April 20, and the stolen funds are no longer under the control of the original address. This move recovers about a quarter of the total amount drained from Kelp's LayerZero-powered bridge, which was exploited by attackers on Saturday. The attackers pulled 116,500 rsETH by exploiting compromised verifier infrastructure, with LayerZero attributing the attack to North Korea's Lazarus Group with preliminary confidence. As a layer-2 blockchain, Arbitrum processes transactions more cheaply and settles them back to the main chain. Its Security Council has emergency powers to take protective action in such scenarios, although governance-level interventions on user funds are rare and controversial. The freeze provides Kelp with a partial recovery option, in addition to any further recovery efforts by law enforcement and chain-tracing firms. It also escalates the dispute between Kelp and LayerZero over responsibility for the exploit, as any broader socialization of remaining losses now has a $71 million offset. Kelp is coordinating with ecosystem partners on a recovery fund and weighing next steps, while LayerZero has not publicly commented on the Arbitrum freeze. The recovery of additional stolen funds depends on the attacker's movements of rsETH or its derivatives and whether other chains with similar emergency powers choose to act.