The Arbitrum Security Council freeze happened Monday night. The council moved 30,766 ETH (worth roughly $71 million) from the Saturday rsETH exploit into an intermediary wallet. That wallet can only be accessed through further Arbitrum governance action. In plain English: the stolen funds are no longer under the attacker’s control.
This recovery represents about a quarter of the total $292 million drained from Kelp’s LayerZero‑powered bridge. The exploit happened on Saturday. Attackers pulled 116,500 rsETH by compromising verifier infrastructure. LayerZero attributes the attack with “preliminary confidence” to North Korea’s Lazarus Group.
Why the Arbitrum Security Council Freeze Matters
Arbitrum is a layer‑2 blockchain – a network on top of Ethereum that processes transactions cheaply and settles them to the main chain. Its Security Council is a group of elected signers with emergency powers. They can step in during exactly this kind of scenario. However, governance‑level interventions on user funds remain rare and controversial. Why? Because they introduce a degree of discretionary control over an otherwise permissionless network.
The council said it acted on input from law enforcement regarding the exploiter’s identity. Importantly, the freeze happened “without impacting any Arbitrum users or applications.”
What’s Next for Kelp and LayerZero?
The Arbitrum Security Council freeze leaves Kelp with a partial recovery option. Kelp is now coordinating with ecosystem partners on a recovery fund. They’re weighing next steps on unpausing, loss socialization, and legal coordination. LayerZero has not yet publicly commented.
Whether more stolen funds can be frozen depends on where else the attacker moved rsETH or its derivatives before consolidation. Other chains with similar emergency powers could choose to act on their portions of the flow.
My Thoughts
This is a double‑edged sword. On one hand, freezing $71M is a win for victims. It shows that layer‑2 governance can act fast when law enforcement provides credible intel. On the other hand, it raises a fundamental question: how decentralized is Arbitrum really? If a small council can seize funds, then the “permissionless” label starts to crack. For traders, this sets a precedent. Future exploits on L2s with similar councils might see partial recovery – which is bullish for risk management. But it also means regulators will push for more such powers. Watch for community backlash. For now, credit where it’s due: the council did its job.
