Arbitrum Secures $71 Million in Ether Linked to Kelp DAO Exploit

The Kelp DAO exploit has resulted in a significant portion of stolen funds being frozen. On Monday night, Arbitrum's Security Council took action to freeze approximately $71 million worth of ether, specifically 30,766 ETH, by moving the funds to an intermediary wallet that can only be accessed through additional governance measures. This action was taken in response to the $292 million rsETH exploit that occurred on Saturday. rsETH is a liquid restaking token representing a user's position in restaked ether. The Arbitrum Security Council, with input from law enforcement regarding the exploiter's identity, executed the freeze without impacting any users or applications on the network. The transfer was completed at 11:26 p.m. ET on April 20, and the stolen funds are no longer under the control of the original address. This move recovers about a quarter of the total amount drained from Kelp's LayerZero-powered bridge on Saturday, when attackers exploited compromised verifier infrastructure to pull 116,500 rsETH. The attack has been attributed to North Korea's Lazarus Group with preliminary confidence. As a layer-2 blockchain, Arbitrum processes transactions more cheaply and settles them back to the main chain, with its Security Council having emergency powers to take protective action in such scenarios. However, interventions on user funds at the governance level are rare and controversial due to the introduction of discretionary control over an otherwise permissionless network. The freeze provides Kelp with a partial recovery option and escalates the ongoing dispute between Kelp and LayerZero over responsibility for the exploit. Kelp is coordinating with ecosystem partners on a recovery fund and weighing next steps, while LayerZero has not publicly commented on the Arbitrum freeze. The ability to freeze more stolen funds depends on the attacker's movements of rsETH or its derivatives and whether other chains choose to act on their portions of the flow.