Arbitrum Security Council Freezes 30,766 ETH Worth About $71 Million Linked to KelpDAO Exploit

Arbitrum’s Security Council executed an emergency freeze tied to the KelpDAO exploit, locking 30,766 ETH worth about $71 million in a governance-controlled intermediary wallet.

Multiple outlets tied the action to the same underlying theft: attackers drained 116,500 rsETH from Kelp DAO’s LayerZero-powered bridge after exploiting compromised verifier infrastructure.

@coindesk

CoinDesk reported that the Security Council moved “30,766 ETH worth roughly $71 million” into an intermediary wallet “that can only be accessed through further Arbitrum governance action,” and said the transfer completed at 11:26 p.m. ET on April 20.

The Block similarly described the freeze as “about $71 million in ETH linked to the exploit,” noting it came days after the weekend disclosure of the roughly $292 million rsETH theft.

CoinCentral put the timing as “freezing 30,766 ETH worth approximately $71 million” on Monday night, and said the funds were moved to an intermediary wallet “that can only be accessed through further Arbitrum governance action.”

Across the coverage, the freeze is framed as a containment step: CoinDesk said it “prevents the original exploiter from accessing the seized funds,” while CoinCentral said “The stolen ether is no longer accessible to the address that originally held it.”

The freeze followed a KelpDAO bridge exploit that multiple reports tied to LayerZero’s cross-chain verification path and a compromised verifier setup.

TradingView described the bridge theft as occurring on “April 18–19,” when “an attacker drained 116,500 rsETH from Kelp DAO’s LayerZero-based bridge,” and said the exploit was “about $292–293 million at the time.”

@coindesk

It also described a technical root cause in terms of verification: “Kelp ran a 1‑of‑1 verifier configuration for LayerZero’s Decentralized Verifier Network,” and said that once the attacker controlled that view, they “effectively controlled the bridge.”

CoinDesk and Coinpedia both tied the theft to compromised verifier infrastructure, with CoinDesk stating attackers “pulled 116,500 rsETH by exploiting compromised verifier infrastructure.”

Coinpedia added that LayerZero’s preliminary attribution pointed to “North Korea’s Lazarus Group,” and said “LayerZero has not publicly commented on the Arbitrum freeze.”

After the exploit, the stolen assets moved quickly enough that Arbitrum’s Security Council acted without waiting for full attribution, according to AMBCrypto, which said “Arbitrum [ARB]did not wait for full attribution” and that the Security Council “used emergency powers to move assets before they dispersed across chains.”

The freeze sparked debate over whether emergency powers undermine decentralization, and multiple outlets quoted named figures arguing for different interpretations of the same action.

“In DeFi, stolen funds rarely return”

AMBCrypto

CoinDesk quoted Arbitrum co-founder Steven Goldfeder of Offchain Labs describing the decision-making sequence as “The default was do nothing,” and said the idea emerged “a way to do it in a very surgical way… without affecting any other user, not affecting the network performance and not having any downtime.”

CoinDesk also quoted Patrick McCorry, head of research at the Arbitrum Foundation, emphasizing transparency and election mechanics: the Security Council is “a very transparent part of the system,” and “they’re elected by token holders… not hand-picked by us [Arbitrum Foundation + Offchain Labs].”

CoinCentral quoted council member Griff Green saying the group “did not make this decision lightly,” and added that there were “countless hours of debates, technical, practical, ethical and political.”

DL News quoted Green with a different emphasis, saying “But all it takes for evil to triumph is for good men to do nothing, so today, we decided to do something.”

The Defiant included a named critique from YCC founder Duo Nine, who called the move “Good move for the users affected, bad new for decentralization,” and added “This sets a precedent where with good justification any assets on Arbitrum can be taken from your wallet.”

Coverage diverged on what the freeze represents, with some outlets foregrounding security and recovery while others foreground governance power and precedent.

CoinDesk framed the action as a protective measure that “prevents the original exploiter from accessing the seized funds,” while also describing the controversy as “governance-level interventions on user funds remain rare and controversial because they introduce a degree of discretionary control over an otherwise permissionless network.”

CoinCentral

AMBCrypto emphasized the technical containment and speed, saying the Security Council “froze 30,766 ETH tied to the KelpDAO exploit” and that the emergency move “secured roughly a quarter of the stolen funds, limiting immediate losses.”

Startup Fortune described the same freeze as both architecture proof and warning sign, saying the intervention “moved fast enough to prevent the funds from being bridged back to Ethereum mainnet or offloaded through decentralized exchanges , which, depending on your perspective, is either a testament to Arbitrum’s security architecture or a warning sign about who really controls these networks.”

CryptoRank and Coinpedia leaned into the “freeze button” narrative but with different tones: CryptoRank called it “a decisive blow” and said it “represents one of the largest single asset freezes,” while Coinpedia highlighted the governance override debate and quoted a user asking, “So a council can just freeze 30k ETH, and we’re still calling this decentralized?”

The Defiant directly summarized the tension by quoting Duo Nine’s “Good move for the users affected, bad new for decentralization,” and also included Taylor Monahan’s characterization that Arbitrum freezing funds was “rugg[ing] DPRK of $70M.”

Even as Arbitrum froze about $71 million, other reporting described continued movement of stolen funds across chains, raising the stakes for recovery and for how quickly additional freezes could happen.

The Block reported that “wallets tied to the Kelp DAO exploit have begun what appears to be an attempt to launder the stolen funds after the Ethereum Layer 2 network Arbitrum froze some of the assets,” and said “About $1.5 million was moved from Ethereum mainnet to Bitcoin through THORChain, and another roughly $78,000 routed through privacy protocol Umbra.”

CoinDesk

CoinMarketCap’s embedded update in TradingView said “The Kelp DAO exploiter has moved about $175 million in ETH to fresh wallets after Arbitrum froze $71 million tied to the hack,” and it included a link and a timestamped post.

CoinDesk described the freeze as “a partial recovery option” and said “Whether more stolen funds can be frozen depends on where else the attacker moved rsETH or its derivatives before consolidation.”

Coinpedia similarly said “The frozen $71 million represents about a quarter of the total amount stolen” and that “Whether additional stolen funds can be frozen depends on where the attacker moved the assets and whether other chains with similar emergency powers take action.”

Startup Fortune said KelpDAO’s response would be “closely watched,” and stated that “The protocol needs to explain not just what the vulnerability was, but how it passed through security reviews, and what compensation or recovery mechanism it plans to offer affected users.”