Arbitrum Seizes Control of $71 Million in Ether Linked to Kelp DAO Exploit

A significant portion of the Kelp DAO exploit funds has been immobilized. On Monday evening, Arbitrum's Security Council froze approximately $71 million worth of ether, comprising 30,766 ETH, by transferring the funds to an intermediary wallet that can only be accessed through additional Arbitrum governance measures. This action was taken in response to Saturday's $292 million rsETH exploit. The frozen funds are linked to the KelpDAO exploit, in which rsETH, a liquid restaking token representing a user's position in restaked ether, was compromised. The Arbitrum Security Council took emergency action, with input from law enforcement regarding the exploiter's identity, to freeze the 30,766 ETH held in the address connected to the KelpDAO exploit on Arbitrum One. The council executed the freeze without impacting any Arbitrum users or applications. The transfer was completed at 11:26 p.m. ET on April 20, according to Arbitrum's statement. As a result, the stolen funds are no longer under the control of the original address. This move recovers about a quarter of the total amount drained from Kelp's LayerZero-powered bridge on Saturday, when attackers exploited compromised verifier infrastructure to pull 116,500 rsETH. The attack has been attributed to North Korea's Lazarus Group with preliminary confidence by LayerZero. Arbitrum, a layer-2 blockchain built on top of Ethereum, has a Security Council with emergency powers to take protective action in such scenarios. However, governance-level interventions on user funds are rare and controversial due to the introduction of discretionary control over an otherwise permissionless network. The freeze provides Kelp with a partial recovery option, in addition to any further recovery efforts by law enforcement and chain-tracing firms. It also escalates the ongoing dispute between Kelp and LayerZero over responsibility for the exploit, as any broader socialization of remaining losses now has a $71 million offset. Kelp is coordinating with ecosystem partners on a recovery fund and weighing next steps, while LayerZero has not publicly commented on the Arbitrum freeze. The possibility of freezing more stolen funds depends on the attacker's movements of rsETH or its derivatives and whether other chains with similar emergency powers choose to act.