A significant portion of funds from the recent Kelp DAO exploit has been immobilized by Arbitrum’s Security Council. On Monday night, they froze approximately 30,766 ETH, equivalent to around $71 million, after a substantial breach involving rsETH tokens on Saturday resulted in losses amounting to $292 million.
The frozen assets were transferred into an intermediate wallet that requires further governance action for access. The exploited token, rsETH, is issued by KelpDAO and represents staked positions in restaked ether (ETH). This freeze was executed with insights from law enforcement about the identity of the attacker, ensuring no impact on other Arbitrum users or applications.
The action occurred at 11:26 p.m. ET on April 20, as detailed in an official statement by Arbitrum on X. The funds are now isolated from the original address connected to the exploit. This recovery effort accounts for nearly a quarter of the total loss incurred when attackers siphoned 116,500 rsETH using compromised verifier infrastructure, with initial indications pointing towards North Korea’s Lazarus Group.
Arbitrum operates as a layer-2 blockchain built atop Ethereum, enhancing transaction efficiency and settling back to the main chain. Its Security Council comprises elected members empowered to intervene in emergencies like this one. However, such interventions on user funds are infrequent due to concerns over discretionary control over a typically permissionless network.
This development provides Kelp DAO with an avenue for partial recovery, alongside potential further restitution efforts by law enforcement and blockchain analysis firms. Additionally, it intensifies the debate between Kelp and LayerZero regarding liability for the exploit, as any subsequent loss distribution now factors in this $71 million offset before engaging legal, insurance, or treasury solutions.
Kelp is currently collaborating with partners to establish a recovery fund and considering steps related to reactivation, shared loss management, and legal collaboration. Meanwhile, LayerZero has remained silent on the freeze’s implications.
The potential for additional frozen funds hinges on tracking the movement of rsETH or its derivatives across other platforms and whether those networks possess similar emergency intervention capabilities.