Arbitrum freezes $71 million in ether tied to Kelp DAO exploit

The layer-2 network's security council moved 30,766 ETH to a frozen intermediary wallet, accessible only via further governance action.

What to know:

• Arbitrum's Security Council has frozen 30,766 ETH, worth about $71 million, linked to the $292 million rsETH exploit against Kelp DAO, placing the funds in a governance-controlled wallet.
• The emergency action, taken with input from law enforcement and without affecting other Arbitrum users or applications, prevents the original exploiter from accessing the seized funds.
• The freeze recovers roughly a quarter of the stolen assets and intensifies the dispute between Kelp and bridge provider LayerZero over responsibility for the hack and how remaining losses should be shared.

A chunk of the Kelp DAO haul is no longer going anywhere.

Arbitrum's Security Council froze 30,766 ETH worth roughly $71 million on Monday night, moving funds linked to Saturday's $292 million rsETH exploit into an intermediary wallet that can only be accessed through further Arbitrum governance action.

rsETH is a liquid restaking token issued by KelpDAO and represents a user's position in restaked ether (ETH).

The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,…

— Arbitrum (@arbitrum) April 21, 2026

The council said it acted on law enforcement's input regarding the exploiter's identity and executed the freeze "without impacting any Arbitrum users or applications."

The transfer completed at 11:26 p.m. ET on April 20, according to Arbitrum's statement on X. The stolen funds are no longer under the control of the address that originally held them.

The move recovers about a quarter of the total amount drained from Kelp's LayerZero-powered bridge on Saturday, when attackers pulled 116,500 rsETH by exploiting compromised verifier infrastructure. LayerZero attributed the attack with preliminary confidence to North Korea's Lazarus Group.

Arbitrum is a layer-2 blockchain, meaning a network built on top of Ethereum that processes transactions more cheaply and settles them back to the main chain. Its Security Council is a group of elected signers with emergency powers to take protective action in exactly this kind of scenario. However, governance-level interventions on user funds remain rare and controversial because they introduce a degree of discretionary control over an otherwise permissionless network.

The freeze leaves Kelp with a partial recovery option, in addition to whatever else law enforcement and chain-tracing firms can claw back.

It also escalates the ongoing dispute between Kelp and LayerZero over who bears responsibility for the exploit, since any broader socialization of remaining losses now has a $71 million offset to work with before legal coordination, insurance, or treasury contributions come into play.

Kelp has said it is coordinating with ecosystem partners on a recovery fund and weighing next steps on unpausing, loss socialization, and legal coordination with affected counterparties. LayerZero has not publicly commented on the Arbitrum freeze.

Whether more stolen funds can be frozen depends on where else the attacker moved rsETH or its derivatives before consolidation, and whether other chains with similar emergency powers choose to act on their portions of the flow.

More For You

Bitcoin traded at $75,733 on Tuesday morning, up 1.5% over 24 hours, as Iran signaled it will send a team to Pakistan talks and Brent crude slipped ahead of the Wednesday ceasefire deadline.

What to know:

• Bitcoin climbed back above $75,000 as markets bet on progress in cease-fire talks between Iran and Pakistan, even as the current two-week truce nears its Wednesday deadline.
• Despite the rebound, bitcoin continues to lag a broad global equity rally, with negative funding rates in perpetual futures signaling persistent bearish positioning...

A dozen banks want a euro stablecoin. Fireblocks is making it happen

44 minutes ago

Bitcoin reclaims $75,000 as Iran ceasefire talks advance, equities rally resumes

2 hours ago

Ripple wants the XRP Ledger to be quantum-proof by 2028. Here is its plan

3 hours ago

North Korea’s crypto heist playbook is expanding and DeFi keeps getting hit

11 hours ago

Aave could face up to $230 million in losses after Kelp DAO bridge exploit triggers DeFi chaos

11 hours ago

Bitcoin bounces above $76,000 as DeFi suffers $14 billion exodus after KelpDAO hack

11 hours ago

Kelp DAO claims LayerZero’s 'default' settings are what actually caused the massive $290 million disaster

18 hours ago

Coinbase, Bybit said to be working together on tokenization, custody and distribution of U.S. stocks

18 hours ago

Strategy buys 34,164 bitcoin for $2.54 billion, third-largest purchase on record

20 hours ago

Here's how bitcoin's $7.9 billion April options expiry impact prices

22 hours ago

LayerZero blames Kelp's setup for $290 million exploit, attributes it to North Korea's Lazarus

Apr 20, 2026