TLDR
- Arbitrum’s Security Council froze 30,766 ETH (~$71 million) tied to the Kelp DAO exploit
- The funds were moved to a governance-controlled wallet, inaccessible to the original attacker
- The freeze covers roughly a quarter of the $292 million stolen in the Saturday hack
- LayerZero, which powered the exploited bridge, has preliminarily blamed North Korea’s Lazarus Group
- Nine of 12 council members voted for the freeze after hours of debate
Arbitrum’s Security Council took emergency action on Monday night, freezing 30,766 ETH worth approximately $71 million connected to the recent Kelp DAO exploit. The funds were moved to an intermediary wallet that can only be accessed through further Arbitrum governance action.
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,…
— Arbitrum (@arbitrum) April 21, 2026
The freeze was confirmed at 11:26 p.m. ET on April 20. The stolen ether is no longer accessible to the address that originally held it.
The action comes after Kelp DAO’s LayerZero-powered bridge was exploited on Saturday, April 19. Attackers drained 116,500 rsETH by taking advantage of compromised verifier infrastructure. Total losses from the hack are estimated at around $292 to $293 million.
rsETH is a liquid restaking token issued by Kelp DAO. It represents a user’s staked ether position on the network.
LayerZero, the bridge provider involved, said with preliminary confidence that North Korea’s Lazarus Group was behind the attack. LayerZero has not publicly commented on the Arbitrum freeze.
The frozen $71 million represents about a quarter of the total amount stolen. It is the largest single recovery action taken so far in response to the exploit.
How the Freeze Was Decided
Arbitrum’s Security Council is a 12-member body elected by the Arbitrum community. It holds emergency powers for situations like this. Nine of the 12 members voted in favor of freezing the funds.
Council member Griff Green said the group “did not make this decision lightly,” noting there were “countless hours of debates, technical, practical, ethical and political.” The council also said it acted with input from law enforcement.
Arbitrum confirmed the freeze did not affect any other users or applications on its network.
Controversy Over the Freeze
The decision has drawn criticism from parts of the crypto community. Some users on X questioned whether the freeze undermines Arbitrum’s decentralization. Critics argue that freezing funds by council decree goes against the core principles of permissionless blockchain networks.
Supporters of the move say it protects users and maintains the network’s integrity.
The freeze also sharpens an existing dispute between Kelp DAO and LayerZero over who is responsible for the hack. With $71 million now frozen, any future loss-sharing discussions have a partial offset before insurance, legal action, or treasury funds come into play.
The attackers also used stolen Kelp tokens to borrow crypto on the lending platform Aave, creating bad debt across the wider DeFi lending market.
Kelp DAO has said it is working with ecosystem partners on a recovery fund and evaluating next steps on loss socialization and legal coordination.
Whether additional stolen funds can be frozen depends on where the attacker moved the assets and whether other chains with similar emergency powers take action.
