Arbitrum blocks $71M linked to major exploit
Arbitrum freezes $71M ETH after rsETH exploit case
Arbitrum’s Security Council has executed an emergency intervention by freezing 30,766 ETH—worth approximately $71 million—connected to the recent $292 million rsETH exploit involving Kelp DAO. The assets were transferred into a governance-controlled intermediary wallet that can only be accessed through additional Arbitrum governance approval, effectively removing control from the original exploit-linked address.
The action was taken following input from law enforcement regarding the suspected identity behind the exploit. According to Arbitrum, the operation was carried out without impacting normal users or applications on Arbitrum One, and the transfer was completed on April 20 at 11:26 p.m. ET. As a result, the frozen funds are no longer accessible to the attacker and are now under protocol governance oversight.
The incident is tied to an exploit of Kelp DAO’s rsETH system, a liquid restaking token representing staked ETH positions. Attackers reportedly drained around 116,500 rsETH by compromising verifier infrastructure connected to LayerZero-powered bridging components. Early attribution from LayerZero suggested, with preliminary confidence, that the North Korean Lazarus Group may be responsible for the attack.
Arbitrum’s intervention recovers roughly one quarter of the total stolen assets, marking a significant but partial mitigation of losses. The remaining funds are still subject to ongoing tracking efforts by blockchain analytics firms and law enforcement agencies, as attackers may have moved assets across multiple chains and derivatives before consolidation.
Arbitrum is a layer-2 scaling network built on Ethereum, designed to improve transaction speed and reduce costs while inheriting Ethereum’s security guarantees. Its Security Council is composed of elected signers empowered to act in emergencies. While such authority exists to protect ecosystem integrity during critical incidents, direct intervention in user-linked funds remains rare and continues to raise governance and decentralization concerns across the crypto ecosystem.
The freeze has also intensified a broader dispute between Kelp DAO and infrastructure provider LayerZero over responsibility for the exploit. With $71 million now effectively isolated under governance control, discussions around loss allocation, insurance coverage, and recovery planning are shifting. Any remaining shortfall may now be partially offset depending on how the frozen assets are ultimately handled through governance decisions.
Kelp DAO has stated it is coordinating with ecosystem participants on potential recovery mechanisms, including a recovery fund, legal coordination, and strategies for addressing user losses. The project is also evaluating next steps regarding system reactivation and possible loss socialization. LayerZero has not issued a public response regarding Arbitrum’s decision to freeze the funds.
The broader recovery outlook depends on whether additional stolen assets can be traced and frozen across other networks. Since attackers often move funds through multiple chains and liquidity routes, further action by other protocols with similar emergency governance capabilities could influence the total recovery outcome.
This incident highlights the growing tension in decentralized ecosystems between immutable protocol design and emergency governance intervention. While Arbitrum’s action demonstrates an ability to respond quickly to large-scale exploits, it also underscores ongoing debates about discretionary control, decentralization principles, and the role of governance councils in safeguarding user funds during systemic security failures.
Source: https://www.coindesk.com/markets/2026/04/21/arbitr