Arbitrum Security Council Freezes $71 Million in ETH Tied to Kelp DAO Exploit

Arbitrum’s Security Council froze 30,766 ETH worth $71 million linked to the Kelp DAO exploit, recovering roughly a quarter of the $292 million stolen, pending a governance vote on the funds’ fate.

The Arbitrum Security Council executed an emergency freeze of 30,766 ETH, worth approximately $71 million, on April 20, moving funds linked to Saturday’s $292 million Kelp DAO exploit into an intermediary wallet that can only be accessed through further Arbitrum governance action. The transfer completed at 11:26 p.m. ET, according to Arbitrum’s statement on X. The council said it acted with input from law enforcement regarding the exploiter’s identity and conducted technical diligence to confirm no other chain states or Arbitrum users were affected.

Nine of the Security Council’s 12 members voted to execute the action. Council member Griff Green said the decision came after “countless hours of debates, technical, practical, ethical and political.” The frozen funds represent roughly a quarter of the total drained from Kelp’s LayerZero-powered bridge. The attacker had moved the bulk of the stolen rsETH into Aave V3 as collateral, borrowing real wrapped ETH before markets were frozen, and the remaining approximately $220 million is believed to have already been moved through various chains by the suspected Lazarus Group actors.

This story is an excerpt from the Unchained Daily newsletter.

The council’s intervention prompted immediate debate about the limits of decentralization. Arbitrum is a permissionless layer-2 network settled on Ethereum, and the Security Council’s ability to freeze funds controlled by an outside address raises questions about how far emergency powers should extend, even when applied to state-sponsored thieves. The council is a group of elected signers with emergency authority, and supporters of the freeze argued the circumstances, a targeted North Korean hack of DeFi infrastructure, justified the action. The frozen ETH will move only via a further vote by ARB token holders, who will likely decide between returning funds to affected Kelp users or holding them pending law enforcement proceedings.