Arbitrum Secures $71 Million in Ether Linked to Kelp DAO Exploit

A significant portion of the funds stolen from Kelp DAO has been put on hold. On Monday night, Arbitrum's Security Council froze approximately $71 million worth of ether, transferring 30,766 ETH linked to Saturday's $292 million rsETH exploit to an intermediary wallet. This wallet can only be accessed through additional Arbitrum governance actions. The rsETH token, issued by KelpDAO, represents a user's stake in restaked ether. Following input from law enforcement regarding the exploiter's identity, the Security Council took emergency action to freeze the 30,766 ETH held in the address connected to the KelpDAO exploit. The council executed this freeze without affecting any Arbitrum users or applications. The transfer was completed at 11:26 p.m. ET on April 20, according to Arbitrum's statement. The stolen funds are no longer controlled by the original address. This move recovers about a quarter of the total amount drained from Kelp's LayerZero-powered bridge on Saturday, when attackers exploited compromised verifier infrastructure to pull 116,500 rsETH. LayerZero has attributed the attack to North Korea's Lazarus Group with preliminary confidence. As a layer-2 blockchain, Arbitrum processes transactions more cheaply and settles them back to the main chain. Its Security Council has emergency powers to take protective action in scenarios like this, although governance-level interventions on user funds are rare and controversial due to the discretionary control they introduce. The freeze provides Kelp with a partial recovery option, in addition to any further recoveries by law enforcement and chain-tracing firms. It also escalates the ongoing dispute between Kelp and LayerZero over who bears responsibility for the exploit, as any broader socialization of remaining losses now has a $71 million offset. Kelp is coordinating with ecosystem partners on a recovery fund and considering next steps on unpausing, loss socialization, and legal coordination with affected counterparties. Whether more stolen funds can be frozen depends on the attacker's movements of rsETH or its derivatives and whether other chains with similar emergency powers choose to act.