ArbitrumSecurity Council Halts $71 Million in ETH Linked to Kelp DAO Exploit

TLDR

• Arbitrum’s Security Council has frozen 30,766 ETH (around $71 million) connected to the Kelp DAO exploit
• The funds were transferred to a governance-controlled wallet, and the original attacker can no longer access them
• This freeze covers approximately one quarter of the $292 million stolen during Saturday’s hack
• LayerZero, which powered the exploited bridge, has preliminarily pinned the attack on North Korea’s Lazarus Group
• Nine out of 12 council members approved the freeze after hours of discussion

---

(SeaPRwire) –   Arbitrum’s Security Council carried out emergency action on Monday night, freezing 30,766 ETH valued at roughly $71 million linked to the recent Kelp DAO exploit. The funds were moved to an intermediary wallet that can only be accessed through additional Arbitrum governance action.

The Arbitrum Security Council has executed emergency action to freeze the 30,766 ETH held in the address on Arbitrum One connected to the KelpDAO exploit. The Security Council made this move with input from law enforcement regarding the exploiter’s identity, and, at all times,…

— Arbitrum (@arbitrum) April 21, 2026

The freeze was officially confirmed at 11:26 p.m. ET on April 20. The stolen ether is no longer reachable by the address that originally held the funds.

This action follows the exploit of Kelp DAO’s LayerZero-powered bridge on Saturday, April 19. Attackers drained 116,500 rsETH by exploiting compromised verifier infrastructure. Total losses from the hack are estimated to fall between $292 and $293 million.

rsETH is a liquid restaking token issued by Kelp DAO. It represents a user’s staked ether position on the network.

LayerZero, the involved bridge provider, said with preliminary confidence that North Korea’s Lazarus Group was responsible for the attack. LayerZero has not made any public comment on the Arbitrum freeze to date.

The frozen $71 million equals roughly a quarter of the total stolen amount. It is the largest single recovery effort undertaken so far in response to the exploit.

How the Freeze Was Decided

Arbitrum’s Security Council is a 12-member body elected by the Arbitrum community. It holds emergency authority for situations exactly like this. Nine of the 12 members voted in favor of freezing the funds.

Council member Griff Green said the group “did not make this decision lightly,” noting that the body held “countless hours of debates covering technical, practical, ethical and political topics.” The council also confirmed it acted with input from law enforcement.

Arbitrum confirmed the freeze did not impact any other users or applications operating on its network.

Controversy Over the Freeze

The decision has attracted criticism from portions of the crypto community. Some users on X have questioned whether the freeze weakens Arbitrum’s decentralization. Critics argue that freezing funds by council order goes against the core tenets of permissionless blockchain networks.

Supporters of the move say it safeguards users and preserves the network’s integrity.

The freeze also amplifies an existing disagreement between Kelp DAO and LayerZero over who bears responsibility for the hack. With $71 million now frozen, any future loss-sharing negotiations have a partial offset before insurance, legal action, or treasury funds are brought into play.

The attackers also used stolen Kelp tokens to borrow crypto on the lending platform Aave, generating bad debt across the broader DeFi lending market.

Kelp DAO has stated it is working with ecosystem partners to build a recovery fund and evaluating next steps for loss socialization and legal coordination.

Whether additional stolen funds can be frozen depends on where the attacker moved the assets and whether other chains with similar emergency powers choose to take similar action.