Arbitrum Secures $71 Million in Ether Tied to Kelp DAO Exploit

A significant portion of the funds stolen from Kelp DAO is now frozen. On Monday night, Arbitrum's Security Council took action to secure 30,766 ETH, worth around $71 million, linked to the $292 million rsETH exploit that occurred on Saturday. This rsETH is a token representing restaked ether and was issued by KelpDAO. The Security Council, acting on information from law enforcement regarding the identity of the exploiter, moved the funds to an intermediary wallet, accessible only through further governance action. This action was taken without disrupting any users or applications on Arbitrum. According to Arbitrum, the transfer was completed at 11:26 p.m. ET on April 20, and the stolen funds are no longer controlled by the original address. This move recovers about a quarter of the total amount drained from Kelp's bridge on Saturday, when 116,500 rsETH were stolen by exploiting compromised infrastructure. The attack has been attributed to North Korea's Lazarus Group with preliminary confidence by LayerZero. As a layer-2 blockchain, Arbitrum processes transactions more cheaply and settles them on the main Ethereum chain. Its Security Council has the power to take emergency actions, such as this freeze, to protect the network. However, such interventions on user funds are rare and can be controversial due to the discretionary control they introduce. The freeze provides Kelp with a partial recovery option, in addition to any other amounts that law enforcement and chain-tracing firms can recover. It also escalates the dispute between Kelp and LayerZero over responsibility for the exploit, as any further socialization of losses now has a $71 million offset before legal actions, insurance, or treasury contributions are considered. Kelp is coordinating with partners on a recovery fund and considering next steps, while LayerZero has not commented on the freeze. The recovery of additional stolen funds depends on the movement of rsETH and its derivatives by the attacker and whether other chains take similar actions.