A piece of the Kelp DAO haul is not going anyplace.
Arbitrum’s Safety Council froze 30,766 ETH worth roughly $71 million on Monday evening, shifting funds linked to Saturday’s $292 million rsETH exploit into an middleman pockets that may solely be accessed by additional Arbitrum governance motion.
rsETH is a liquid restaking token issued by KelpDAO and represents a consumer’s place in restaked ether (ETH).
The Arbitrum Safety Council has taken emergency motion to freeze the 30,766 ETH being held within the handle on Arbitrum One that’s related to the KelpDAO exploit. The Safety Council acted with enter from regulation enforcement as to the exploiter’s id, and, always,…
— Referee (@referee) April 21, 2026
The council mentioned it acted on regulation enforcement’s enter concerning the exploiter’s id and executed the freeze “with out impacting any Arbitrum customers or functions.”
The switch accomplished at 11:26 p.m. ET on April 20, based on Arbitrum’s assertion on X. The stolen funds are not below the management of the handle that initially held them.
The transfer recovers a couple of quarter of the whole quantity drained from Kelp’s LayerZero-powered bridge on Saturday, when attackers pulled 116,500 rsETH by exploiting compromised verifier infrastructure. LayerZero attributed the attack with preliminary confidence to North Korea’s Lazarus Group.
Arbitrum is a layer-2 blockchain, that means a community constructed on high of Ethereum that processes transactions extra cheaply and settles them again to the primary chain. Its Safety Council is a bunch of elected signers with emergency powers to take protecting motion in precisely this sort of state of affairs. Nevertheless, governance-level interventions on consumer funds stay uncommon and controversial as a result of they introduce a level of discretionary management over an in any other case permissionless community.
The freeze leaves Kelp with a partial restoration possibility, along with no matter else regulation enforcement and chain-tracing companies can claw again.
It additionally escalates the ongoing dispute between Kelp and LayerZero over who bears accountability for the exploit, since any broader socialization of remaining losses now has a $71 million offset to work with earlier than authorized coordination, insurance coverage, or treasury contributions come into play.
Kelp has mentioned it’s coordinating with ecosystem companions on a restoration fund and weighing subsequent steps on unpausing, loss socialization, and authorized coordination with affected counterparties. LayerZero has not publicly commented on the Arbitrum freeze.
Whether or not extra stolen funds could be frozen is dependent upon the place else the attacker moved rsETH or its derivatives earlier than consolidation, and whether or not different chains with comparable emergency powers select to behave on their parts of the stream.
