Some of Kelp DAO’s transportation is no longer going anywhere.
The Arbitrum Security Council froze 30,766 ETH worth approximately $71 million on Monday evening, moving funds related to Saturday’s $292 million rsETH exploit to an intermediary wallet accessible only through other Arbitrum governance actions.
rsETH is a liquid restake token issued by KelpDAO and represents a user’s position in restaked ether (ETH).
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH held in the address on Arbitrum One that is linked to the KelpDAO exploit. The Security Council acted with the assistance of law enforcement as to the identity of the exploiter and, at all times,…
– Arbitrum (@arbitrum) April 21, 2026
The board said it acted on information provided by law enforcement regarding the identity of the exploiter and executed the freeze “without affecting Arbitrum users or applications.”
The transfer was completed at 11:26 p.m. ET on April 20, according to Arbitrum’s statement on X. The stolen funds are no longer under the control of the address that originally held them.
The move recovers about a quarter of the total amount drained from Kelp’s LayerZero-powered bridge on Saturday, when attackers mined 116,500 rsETH by exploiting compromised verification infrastructure. LayerZero attributed the attack with preliminary confidence to the North Korean Lazarus group.
Arbitrum is a layer 2 blockchain, i.e. a network built on Ethereum that processes transactions at a lower cost and integrates them back into the main chain. Its Security Council is a group of elected signatories with emergency powers to take protective measures in precisely this kind of scenario. However, governance-level interventions over user funds remain rare and controversial because they introduce a degree of discretionary control over an otherwise permissionless network.
The freeze leaves Kelp with an option for partial recovery, in addition to whatever law enforcement and chain tracing companies can recover.
It also escalates the ongoing dispute between Kelp and LayerZero over responsibility for the exploit, since any broader socialization of the remaining losses now has a $71 million compensation to work with before legal coordination, insurance, or treasury contributions come into play.
Kelp said it is coordinating with ecosystem partners on a recovery fund and considering next steps on recovery, socialization of losses and legal coordination with relevant counterparties. LayerZero has not publicly commented on the Arbitrum freeze.
The ability to freeze more stolen funds depends on where the attacker moved rsETH or its derivatives before consolidation, and whether other chains with similar emergency powers choose to act on their portions of the flow.
