Arbitrum Freezes $71M in ETH Linked to Kelp DAO rsETH Exploit

Arbitrum’s Security Council has frozen 30,766 ETH, valued at approximately $71 million, in response to the recent Kelp DAO exploit involving its liquid restaking token, rsETH. The emergency action followed a $292 million breach that occurred over the weekend, where attackers exploited vulnerabilities in Kelp’s LayerZero-powered bridge infrastructure.

The frozen funds, which represent about a quarter of the total stolen assets, have been moved to a secure intermediary wallet. This wallet can only be accessed through additional Arbitrum governance decisions, effectively removing control from the attacker’s original address. According to Arbitrum, the intervention was carried out based on input from law enforcement agencies regarding the suspected identity of the exploiter.

rsETH is a liquid restaking token issued by Kelp DAO, allowing users to maintain liquidity while participating in Ethereum restaking. The exploit saw attackers withdraw around 116,500 rsETH by compromising verifier systems. LayerZero has preliminarily linked the attack to North Korea’s Lazarus Group, a notorious cybercrime organization.

Arbitrum, a leading Ethereum layer-2 scaling solution, rarely exercises such governance-level intervention. Its Security Council, composed of elected members, holds emergency powers designed to protect the network during critical incidents. While effective in this case, such actions continue to spark debate over decentralization and control within blockchain ecosystems.

The freeze provides Kelp DAO with a partial recovery pathway, easing some of the financial damage while broader recovery efforts continue. The project is currently working with partners on a recovery fund and evaluating options such as loss socialization, legal coordination, and reopening paused services.

The situation also intensifies the ongoing dispute between Kelp DAO and LayerZero regarding accountability for the exploit. Whether additional funds can be recovered depends on the attacker’s movements across other blockchain networks and whether similar emergency measures are taken elsewhere.