Arbitrum Secures $71 Million in Ether Linked to Kelp DAO Breach

A significant portion of the Kelp DAO stolen funds has been immobilized. Arbitrum's Security Council has frozen approximately $71 million worth of ether, totaling 30,766 ETH, which was linked to the $292 million rsETH exploit that occurred on Saturday. This action was taken on Monday night, transferring the compromised funds to an intermediary wallet that can only be accessed through additional governance measures. The rsETH token, issued by KelpDAO, represents a user's stake in restaked ether. The Security Council's decision to freeze the funds was made in consultation with law enforcement, who provided information about the exploiter's identity. This action did not affect any Arbitrum users or applications. According to Arbitrum's statement, the transfer was completed at 11:26 p.m. ET on April 20, and the stolen funds are no longer controlled by the original address. This move recoveries about a quarter of the total amount stolen from Kelp's LayerZero-powered bridge, which was exploited by attackers who pulled 116,500 rsETH by compromising verifier infrastructure. The attack has been attributed to North Korea's Lazarus Group with preliminary confidence. As a layer-2 blockchain, Arbitrum processes transactions more efficiently and at a lower cost, settling them on the main Ethereum chain. The Security Council's emergency powers allowed them to take protective action, although such interventions on user funds are rare and controversial due to the introduction of discretionary control. The freeze provides Kelp with a partial recovery option, in addition to any further recovery efforts by law enforcement and chain-tracing firms. This development escalates the ongoing dispute between Kelp and LayerZero over who bears responsibility for the exploit, as the $71 million offset will be taken into account before any broader socialization of remaining losses. Kelp is coordinating with ecosystem partners on a recovery fund and exploring next steps, while LayerZero has not publicly commented on the Arbitrum freeze. The possibility of freezing additional stolen funds depends on the attacker's movements of rsETH or its derivatives and whether other chains with similar emergency powers will take action.