Arbitrum freezes $71 million in ether tied to Kelp DAO exploit

A chunk of the Kelp DAO haul is no longer going anywhere.

Arbitrum’s Security Council froze 30,766 ETH worth roughly $71 million on Monday night, moving funds linked to Saturday’s $292 million rsETH exploit into an intermediary wallet that can only be accessed through further Arbitrum governance action.

rsETH is a liquid restaking token issued by KelpDAO and represents a user’s position in restaked ether (ETH).

The council said it acted on law enforcement’s input regarding the exploiter’s identity and executed the freeze “without impacting any Arbitrum users or applications.”

The transfer completed at 11:26 p.m. ET on April 20, according to Arbitrum’s statement on X. The stolen funds are no longer under the control of the address that originally held them.

The move recovers about a quarter of the total amount drained from Kelp’s LayerZero-powered bridge on Saturday, when attackers pulled 116,500 rsETH by exploiting compromised verifier infrastructure. LayerZero attributed the attack with preliminary confidence to North Korea’s Lazarus Group.

Arbitrum is a layer-2 blockchain, meaning a network built on top of Ethereum that processes transactions more cheaply and settles them back to the main chain. Its Security Council is a group of elected signers with emergency powers to take protective action in exactly this kind of scenario. However, governance-level interventions on user funds remain rare and controversial because they introduce a degree of discretionary control over an otherwise permissionless network.

The freeze leaves Kelp with a partial recovery option, in addition to whatever else law enforcement and chain-tracing firms can claw back.

It also escalates the ongoing dispute between Kelp and LayerZero over who bears responsibility for the exploit, since any broader socialization of remaining losses now has a $71 million offset to work with before legal coordination, insurance, or treasury contributions come into play.

Kelp has said it is coordinating with ecosystem partners on a recovery fund and weighing next steps on unpausing, loss socialization, and legal coordination with affected counterparties. LayerZero has not publicly commented on the Arbitrum freeze.

Whether more stolen funds can be frozen depends on where else the attacker moved rsETH or its derivatives before consolidation, and whether other chains with similar emergency powers choose to act on their portions of the flow.