Arbitrum

LayerZero

Green

Security

Time

<h3 id="tldr">TLDR</h3>
<ul>
 <li>Emergency governance action by Arbitrum’s Security Council immobilized 30,766 ETH (approximately $71 million) connected to the Kelp DAO security breach</li>
 <li>The secured assets were transferred to a governance-controlled address, preventing attacker access</li>
 <li>This recovery represents approximately 25% of the total $292 million lost in the weekend attack</li>
 <li>North Korea’s Lazarus Group has been identified by LayerZero as the preliminary suspect behind the exploit</li>
 <li>The emergency measure passed with nine affirmative votes from the 12-member council</li>
</ul>
In an unprecedented emergency response late Monday evening, Arbitrum’s Security Council executed a freeze on 30,766 ETH valued at roughly $71 million that was traced to the Kelp DAO security breach. The cryptocurrency has been relocated to an intermediary address requiring additional governance authorization for any future access.
<blockquote class="twitter-tweet">
 The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,…
 — Arbitrum (@arbitrum) <a href="https://twitter.com/arbitrum/status/2046435443680346189?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">April 21, 2026</a>
</blockquote>
The emergency freeze became effective at 11:26 p.m. Eastern Time on April 20. The compromised address that initially controlled these assets can no longer access the frozen ethereum.
This intervention follows Saturday’s major security incident on April 19, when malicious actors exploited Kelp DAO’s LayerZero-integrated bridge infrastructure. The attackers successfully extracted 116,500 rsETH by exploiting vulnerabilities in compromised verification systems. The complete financial impact of this breach ranges between $292 and $293 million.
rsETH functions as a liquid restaking token provided by <a href="https://coincentral.com/defi-loses-over-600-million-in-weeks-after-kelp-dao-and-drift-exploits/" rel="noopener noreferrer nofollow">Kelp DAO.</a> This token serves as a representation of staked ethereum holdings within the protocol.
LayerZero, the infrastructure provider whose technology was exploited, has indicated with reasonable certainty that North Korea’s notorious Lazarus Group orchestrated the attack. The company has not issued public statements regarding the Arbitrum asset freeze.
The $71 million in secured funds accounts for roughly one-quarter of the total stolen amount. This marks the most significant single recovery effort undertaken in response to the security breach thus far.
<h3 id="how-the-freeze-was-decided">How the Freeze Was Decided</h3>
<a href="https://coincentral.com/arbitrum-issues-urgent-warning-after-x-account-gets-compromised/" rel="noopener noreferrer nofollow">Arbitrum’s</a> Security Council comprises 12 community-elected members vested with emergency authority for critical situations. The freeze resolution received approval from nine council members.
Council member Griff Green emphasized the gravity of their decision, stating the group “did not make this decision lightly,” and referenced “countless hours of debates, technical, practical, ethical and political.” The council confirmed coordination with law enforcement authorities during their deliberations.
Arbitrum has verified that the emergency action impacted no other users or decentralized applications operating on the network.
<h3 id="controversy-over-the-freeze">Controversy Over the Freeze</h3>
The emergency measure has sparked debate within the cryptocurrency community. Several users on X have raised concerns about whether this action compromises Arbitrum’s decentralized nature. Detractors contend that executive freezing of assets through council authority contradicts fundamental blockchain principles of permissionless operation.
Proponents defend the intervention as necessary for user protection and preserving network credibility.
The freeze intensifies ongoing tensions between Kelp DAO and LayerZero regarding accountability for the security failure. With $71 million now secured, any forthcoming negotiations about loss allocation begin with this partial recovery before considering insurance claims, legal remedies, or treasury contributions.
The perpetrators additionally leveraged stolen Kelp tokens as collateral for cryptocurrency loans on Aave’s lending platform, generating uncollateralized debt throughout the broader decentralized finance ecosystem.
Kelp DAO has announced collaborative efforts with ecosystem participants to establish a recovery fund and is assessing options for loss distribution and legal coordination.
The possibility of recovering additional stolen assets hinges on the attacker’s movement of funds and whether other blockchain networks with comparable emergency capabilities decide to intervene.
The post <a href="https://blockonomi.com/arbitrum-security-council-seizes-71m-in-eth-following-kelp-dao-security-breach/" rel="noopener noreferrer nofollow">Arbitrum Security Council Seizes $71M in ETH Following Kelp DAO Security Breach</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Arbitrum Security Council Seizes $71M in ETH Following Kelp DAO Security Breach

Table of Contents

Blockonomi

Other articles published on Apr 21, 2026

Join our free newsletter for daily crypto updates!