Arbitrum Secures $71 Million in Ether Linked to Kelp DAO Exploit

A significant portion of the funds stolen from Kelp DAO has been immobilized. Arbitrum's Security Council has frozen approximately $71 million worth of ether, valued at 30,766 ETH, which was linked to the $292 million rsETH exploit that occurred on Saturday. This action was taken on Monday night, with the funds being transferred to an intermediary wallet that can only be accessed through additional governance actions by Arbitrum. The rsETH token, issued by KelpDAO, represents a user's stake in restaked ether. Following input from law enforcement regarding the exploiter's identity, the Security Council took emergency action to freeze the ETH held in the address connected to the KelpDAO exploit. This action was executed without disrupting any Arbitrum users or applications, according to the council. The transfer was completed at 11:26 p.m. ET on April 20, as announced by Arbitrum on X. As a result, the stolen funds are no longer under the control of the original address. This move recovers around a quarter of the total amount drained from Kelp's LayerZero-powered bridge on Saturday, when attackers exploited compromised verifier infrastructure to pull 116,500 rsETH. LayerZero has attributed the attack to North Korea's Lazarus Group with preliminary confidence. Arbitrum, a layer-2 blockchain built on top of Ethereum, offers cheaper transaction processing and settlement back to the main chain. Its Security Council, comprising elected signers with emergency powers, took protective action in this scenario. However, interventions on user funds at the governance level are rare and contentious, as they introduce discretionary control over an otherwise permissionless network. The freeze provides Kelp with a partial recovery option, in addition to any further recoveries by law enforcement and chain-tracing firms. This development escalates the ongoing dispute between Kelp and LayerZero over responsibility for the exploit, as any broader socialization of remaining losses now has a $71 million offset before legal coordination, insurance, or treasury contributions come into play. Kelp is coordinating with ecosystem partners on a recovery fund and considering next steps on unpausing, loss socialization, and legal coordination with affected counterparties. LayerZero has not publicly commented on the Arbitrum freeze. The potential for freezing additional stolen funds depends on the attacker's movements of rsETH or its derivatives before consolidation and whether other chains with similar emergency powers choose to act on their portions of the flow.