Arbitrum Security Council Seizes $71 Million in Ether Linked to Kelp DAO Breach

A significant portion of the funds stolen from Kelp DAO is now frozen. On Monday night, Arbitrum's Security Council took decisive action, freezing 30,766 ETH, valued at roughly $71 million, connected to Saturday's $292 million rsETH exploit. The frozen funds were transferred to an intermediary wallet, accessible only through additional Arbitrum governance procedures. The rsETH token, issued by KelpDAO, represents a user's stake in restaked ether. Following input from law enforcement regarding the exploiter's identity, the Security Council executed the freeze without disrupting any Arbitrum users or applications. According to Arbitrum's statement, the transfer was completed at 11:26 p.m. ET on April 20. The stolen funds are no longer controlled by the original address. This move recovers approximately a quarter of the total amount drained from Kelp's LayerZero-powered bridge on Saturday, when attackers exploited compromised verifier infrastructure, pulling 116,500 rsETH. The incident has been attributed to North Korea's Lazarus Group with preliminary confidence by LayerZero. As a layer-2 blockchain, Arbitrum processes transactions at a lower cost and settles them on the main Ethereum chain. Its Security Council holds emergency powers to take protective action in such scenarios, although governance-level interventions on user funds are rare and contentious due to the introduction of discretionary control over an otherwise permissionless network. The freeze provides Kelp with a partial recovery option, in addition to any further recovery efforts by law enforcement and chain-tracing firms. It also escalates the ongoing dispute between Kelp and LayerZero over responsibility for the exploit, as any broader socialization of remaining losses now has a $71 million offset. Kelp is coordinating with ecosystem partners on a recovery fund and weighing next steps, while LayerZero has not publicly commented on the Arbitrum freeze. The potential for freezing additional stolen funds depends on the attacker's movements of rsETH or its derivatives and whether other chains with similar emergency powers choose to act.