Part of the Kelp DAO move is no longer going anywhere.
Arbitrum’s Security Council on Monday night froze 30,766 ETH worth about $71 million, moving funds tied to Saturday’s $292 million rsETH exploit into an intermediate wallet that can only be accessed through further Arbitrum governance actions.
rsETH is a floating restaking token issued by KelpDAO and represents a user’s position in restaking ether (ETH).
The Arbitrum Security Council has taken emergency measures to freeze the 30,766 ETH held at the address of Arbitrum One associated with the KelpDAO exploit. The Security Council acted with input from law enforcement regarding the exploiter’s identity, and at all times…
— Arbitrum (@arbitrum) 21 April 2026
The council said it acted on input from law enforcement agencies regarding the exploiter’s identity and carried out the freeze “without affecting any Arbitrum users or applications.”
The transfer was completed at 11:26 PM ET on April 20, according to Arbitrum’s statement on X. The stolen funds are no longer under the control of the address that originally held them.
The move recovers about a quarter of the total amount drained from Kelp’s LayerZero-powered bridge on Saturday, when attackers extracted 116,500 rsETH by exploiting compromised verifier infrastructure. LayerZero attributed the attack with tentative confidence to North Korea’s Lazarus group.
Arbitrum is a layer-2 blockchain, meaning a network built on top of Ethereum that processes transactions cheaper and settles them back to the main chain. Its Security Council is a group of elected signatories with emergency powers to take protective action in just this kind of scenario. However, government-level intrusions into user assets remain rare and controversial because they introduce a degree of discretionary control over an otherwise permissionless network.
The freeze leaves Kelp with a partial recovery option, beyond anything else law enforcement and chain-tracing companies can fight back.
It also escalates the ongoing dispute between Kelp and LayerZero over who bears responsibility for the exploit, as any wider socialization of residual losses now has a $71 million offset to work with before legal coordination, insurance or treasury contributions come into play.
Kelp has said it is coordinating with ecosystem partners on a recovery fund and weighing next steps in recovery, loss socialization and legal coordination with affected counterparties. LayerZero has not publicly commented on the Arbitrum freeze.
Whether more stolen money can be frozen depends on where else the attacker moved rsETH or its derivatives before consolidation, and whether other chains with similar emergency powers choose to act on their parts of the flow.
