Arbitrum's Security Council has frozen 30,766 ETH linked to the Kelp DAO exploit, valued in the source report at roughly $71 million. The funds were moved Monday night into an intermediary wallet that can only be accessed through additional Arbitrum governance action, removing them from the control of the address that originally held the stolen assets.
According to Arbitrum's statement on X, the transfer was completed at 11:26 p.m. ET on April 20. The council said it acted based on input from law enforcement regarding the exploiter's identity and carried out the freeze “without impacting any Arbitrum users or applications.”
Frozen assets came from the rsETH exploit
The seized funds represent part of the haul from Saturday's Kelp DAO attack. The source says attackers drained 116,500 rsETH from Kelp's LayerZero-powered bridge by exploiting compromised verifier infrastructure, in an incident totaling about $292 million.
rsETH is a liquid restaking token issued by Kelp DAO that represents a user's position in restaked ether. Based on the figures disclosed, the Arbitrum action secures about one quarter of the total amount taken, giving Kelp a partial recovery path as the broader response continues.
LayerZero points preliminarily to Lazarus Group
On attribution, LayerZero said it had preliminary confidence that North Korea's Lazarus Group was behind the attack. For any larger recovery, much depends on where the attacker moved rsETH or related assets before consolidation and whether those flows touched other chains.
If other networks with comparable emergency powers choose to intervene, additional freezes could follow. The source does not indicate that any other chain has taken similar action so far.
Governance intervention remains rare
Arbitrum is a layer-2 blockchain built on Ethereum, designed to process transactions more cheaply and settle them back to the main chain. Its Security Council is a set of elected signers with emergency authority for protective action in scenarios like this one.
That kind of governance-level intervention over user funds is unusual, and it remains contentious. The reason is straightforward: it introduces a measure of discretionary control into a network that is otherwise meant to operate without permission.
Kelp gains a partial recovery option
The freeze gives Kelp another route for partial recovery alongside law enforcement work and blockchain tracing efforts. The source also notes that the move raises the stakes in the dispute between Kelp and LayerZero over responsibility, because the $71 million now sits as a recoverable offset before legal coordination, insurance, or treasury support are considered.
Kelp has said it is working with ecosystem partners on a recovery fund and weighing next steps around unpausing, socializing losses, and legal coordination with affected counterparties. LayerZero has not publicly commented on Arbitrum's freeze.