Arbitrum Freezes $71M ETH Linked to Kelp DAO Exploit

The freeze, executed with law enforcement input, prevents the exploiter from accessing the seized funds without further governance approval and recovers roughly a quarter of the stolen assets, intensifying debate over liability between Kelp DAO and bridge provider LayerZero.

What Happened: Overview of the Kelp DAO Exploit and Arbitrum's Intervention

On April 18, 2026, attackers exploited compromised verifier infrastructure in Kelp DAO's LayerZero-powered rsETH bridge, withdrawing approximately 116,500 rsETH tokens valued at nearly $292 million. The rsETH token represents users' positions in restaked ether and plays a critical role in the liquid restaking ecosystem.

Following the exploit, Arbitrum's Security Council acted decisively on April 20, 2026, moving 30,766 ETH (about $71 million) from the attacker's control to a frozen intermediary wallet at 11:26 p.m. ET, accessible only through governance-led action.

Arbitrum tweeted: "The Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, without impacting any Arbitrum users or applications."

Key takeaway: This freeze constitutes roughly 25% of the total stolen ether—providing a partial financial recovery"

Technical Explanation: What Is rsETH and How Did the Exploit Occur?

rsETH is a liquid restaking token issued by Kelp DAO, representing a user's restaked position in Ethereum. It allows users to maintain staking rewards while enabling liquidity through tokenization.

The attacker exploited the compromised verifier infrastructure within Kelp DAO's bridge utilizing LayerZero technology, facilitating the unauthorized transfer of 116,500 rsETH tokens. LayerZero preliminarily attributed the attribution to North Korea's notorious Lazarus Group, a cybercrime entity known for sophisticated crypto thefts.

This security breach highlights vulnerabilities in cross-chain bridge verifiers and the potential risks associated with liquid restaking protocols.

The Role of Arbitrum's Security Council

Arbitrum functions as a layer-2 blockchain on top of Ethereum, designed to offer cheaper and faster transactions while settling back to the main chain for security.

Its Security Council is composed of elected signers with emergency powers to intervene in crisis situations such as hacks. Though governance-level freezes are rare and sometimes controversial due to discretionary control concerns in a permissionless network, this action underscores Arbitrum’s commitment to protecting its ecosystem integrity.

Kate Harrison, Blockchain Security Expert at CertiChain, stated: "Arbitrum’s freeze reflects a growing trend where governance bodies step in to secure user funds post-exploit, balancing decentralization with pragmatic crisis management."

Dispute Between Kelp DAO and LayerZero

The freeze introduces a new dynamic in the ongoing dispute over responsibility between Kelp DAO and LayerZero. Kelp DAO has criticized LayerZero’s default settings for causing the exploit.

Conversely, LayerZero has publicly attributed the attack primarily to technical misconfiguration within Kelp DAO’s setup and the alleged involvement of Lazarus Group.

Kelp DAO announced it is coordinating with ecosystem partners about a recovery fund, evaluating options to unpause protocols, socialize losses, and legally coordinate with stakeholders. LayerZero has not yet commented on Arbitrum’s freeze action.

Broader Market and Security Implications

The arrest of funds marks a critical milestone in responses to the increasing frequency of DeFi bridge exploits impacting the market, which increasingly demand quicker intervention and coordination between governance, law enforcement, and forensic analytics.

This incident underscores the challenges facing liquid restaking and bridge architectures in ensuring both liquidity and security.

Table: Key Facts at a Glance

Metric	Value	Context
Total stolen (rsETH)	116,500 tokens	Equivalent to $292 million approximately
ETH frozen by Arbitrum	30,766 ETH	About $71 million, ~25% of total stolen
Date of exploit	April 18, 2026	Vulnerability exploited in LayerZero bridge
Freeze execution date	April 20, 2026	Frozen to governance-controlled intermediary wallet
Attributed attacker group	Lazarus Group	North Korean state-backed threat actor (prelim)

Final Takeaway

Arbitrum’s freezing of $71 million worth of stolen ether marks a pivotal step in responding to one of 2026’s largest DeFi exploits, showcasing a growing willingness of governance entities to act decisively against cybercrime. By recovering approximately one-quarter of the stolen assets within days, Arbitrum sets a precedent for crisis intervention in the layered blockchain ecosystem.

However, this incident amplifies ongoing debates on responsibility allocation between protocol developers and bridge providers, emphasizing the critical need for enhanced security protocols in increasingly interconnected DeFi architectures.

As liquid restaking and cross-chain bridge use continue to expand, this episode will likely influence future governance designs and forensic collaborations, with the crypto community closely watching how additional stolen funds are managed and recovered.