In an emergency measure, the Arbitrum Security Council has immobilized 30,766 ETH, valued at $71.5 million, allegedly linked to the recent KelpDAO breach, transferring these funds to a holding wallet.
The decision, confirmed via tweet by the council, was made following law enforcement advice regarding the identity of the perpetrator. Consequently, the funds are now inaccessible to the original account holder and can only be moved through further Arbitrum governance actions in coordination with relevant entities.
“In response to an emergency situation concerning 30,766 ETH tied to the KelpDAO breach on Arbitrum One, the Security Council, guided by law enforcement insights into the identity of the exploiter, has taken swift action,” stated the council in a tweet dated April 21, 2026.
The Arbitrum Security Council, composed of elected members endowed with emergency powers, can freeze assets and transfer them to wallets only accessible via future governance votes. This capability is intended to protect the layer-2 network during security crises.
Currently held in an intermediary address, access to these frozen funds requires community approval through Arbitrum’s governance system.
This action has sparked discussions about layer-2 governance dynamics and the balance between prompt security responses and decentralized principles, with opinions divided over Arbitrum’s unilateral power to freeze assets during emergencies.
KelpDAO, a liquid restaking protocol, experienced a $292 million breach on April 18 when attackers siphoned off 116,500 rsETH tokens. Subsequently, LayerZero implicated North Korea’s Lazarus Group in the attack.
The attackers reportedly breached RPC nodes within LayerZero’s network, corrupting two and launching DDoS attacks on another. Following this incident, a disagreement arose between LayerZero and KelpDAO concerning security setup documentation standards.
In recent developments, funds associated with the breach have been moved. On-chain data shows transfers of $57.93 million and $117.48 million from the wallet linked to the KelpDAO hacker on Tuesday morning. Blockchain analyst ZachXBT reported that the attackers began laundering $1.5 million of the stolen ETH into Bitcoin through Thorchain, with an additional $78,000 funneled via Umbra.