A bit of the Kelp DAO haul is now not going anyplace.
Arbitrum’s Safety Council froze 30,766 ETH price roughly $71 million on Monday night time, transferring funds linked to Saturday’s $292 million rsETH exploit into an middleman pockets that may solely be accessed by additional Arbitrum governance motion.
rsETH is a liquid restaking token issued by KelpDAO and represents a consumer’s place in restaked ether (ETH).
The Arbitrum Safety Council has taken emergency motion to freeze the 30,766 ETH being held within the deal with on Arbitrum One that’s linked to the KelpDAO exploit. The Safety Council acted with enter from legislation enforcement as to the exploiter’s identification, and, always,…
— Arbitrum (@arbitrum) April 21, 2026
The council mentioned it acted on legislation enforcement’s enter concerning the exploiter’s identification and executed the freeze “without impacting any Arbitrum users or applications.”
The switch accomplished at 11:26 p.m. ET on April 20, in accordance with Arbitrum’s assertion on X. The stolen funds are now not underneath the management of the deal with that initially held them.
The transfer recovers a few quarter of the full quantity drained from Kelp’s LayerZero-powered bridge on Saturday, when attackers pulled 116,500 rsETH by exploiting compromised verifier infrastructure. LayerZero attributed the assault with preliminary confidence to North Korea’s Lazarus Group.
Arbitrum is a layer-2 blockchain, that means a community constructed on prime of Ethereum that processes transactions extra cheaply and settles them again to the primary chain. Its Safety Council is a gaggle of elected signers with emergency powers to take protecting motion in precisely this sort of situation. Nevertheless, governance-level interventions on consumer funds stay uncommon and controversial as a result of they introduce a level of discretionary management over an in any other case permissionless community.
The freeze leaves Kelp with a partial restoration choice, along with no matter else legislation enforcement and chain-tracing corporations can claw again.
It additionally escalates the continuing dispute between Kelp and LayerZero over who bears duty for the exploit, since any broader socialization of remaining losses now has a $71 million offset to work with earlier than authorized coordination, insurance coverage, or treasury contributions come into play.
Kelp has mentioned it’s coordinating with ecosystem companions on a restoration fund and weighing subsequent steps on unpausing, loss socialization, and authorized coordination with affected counterparties. LayerZero has not publicly commented on the Arbitrum freeze.
Whether or not extra stolen funds might be frozen relies on the place else the attacker moved rsETH or its derivatives earlier than consolidation, and whether or not different chains with related emergency powers select to behave on their parts of the move.
