Arbitrum Secures $71 Million in Ether Linked to Kelp DAO Exploit

A significant portion of the funds stolen from Kelp DAO has been put on hold. On Monday evening, Arbitrum's Security Council took action to freeze approximately $71 million worth of ether, totaling 30,766 ETH, which was linked to the $292 million rsETH exploit that occurred on Saturday. This liquid restaking token, issued by KelpDAO, represents a user's stake in restaked ether. The Security Council, acting on information provided by law enforcement regarding the identity of the exploiter, transferred the funds to an intermediary wallet that can only be accessed through additional Arbitrum governance procedures. This action was taken without disrupting any Arbitrum users or applications. The transfer was completed at 11:26 p.m. ET on April 20, as announced by Arbitrum on X, effectively removing control of the stolen funds from the original address. This move recovers about a quarter of the total amount drained from Kelp's LayerZero-powered bridge on Saturday, when attackers exploited compromised verifier infrastructure to pull 116,500 rsETH. LayerZero has attributed the attack to North Korea's Lazarus Group with preliminary confidence. As a layer-2 blockchain, Arbitrum processes transactions at a lower cost and settles them back to the main Ethereum chain. Its Security Council, comprising elected signers with emergency powers, took protective action in this scenario. However, such interventions on user funds are rare and controversial, as they introduce discretionary control over an otherwise permissionless network. The freeze provides Kelp with a partial recovery option, in addition to any potential recoveries by law enforcement and chain-tracing firms. It also escalates the dispute between Kelp and LayerZero over responsibility for the exploit, as any broader socialization of remaining losses now has a $71 million offset before considering legal coordination, insurance, or treasury contributions. Kelp is coordinating with ecosystem partners on a recovery fund and weighing next steps on unpausing, loss socialization, and legal coordination with affected counterparties, while LayerZero has not publicly commented on the Arbitrum freeze. The potential for freezing additional stolen funds depends on the attacker's movements of rsETH or its derivatives before consolidation and whether other chains with similar emergency powers choose to act.