According to latest reports, Arbitrum's Security Council executed an emergency freeze of 30,766 ETH worth approximately $71 million on April 20 at 11:26 PM ET, moving funds linked to the Kelp DAO bridge exploit into an intermediary wallet. The freeze recovered roughly 25% of the $293 million stolen from Kelp's cross-chain bridge on April 18, making it one of the fastest high-stakes interventions in DeFi history. Nine of the council's 12 members signed off on the emergency action after consulting with law enforcement about the exploiter's identity. The frozen funds were transferred to an intermediary wallet controlled by the governance system, with access now requiring a full Arbitrum DAO vote, meaning ARB token holders will ultimately decide what happens to the $71 million.
The DeFi ecosystem has mobilized significant resources to address the collateral shortfall following the Kelp DAO exploit. Consensys and founder Joseph Lubin have pledged up to 30,000 ETH to support the DeFi United recovery initiative, with Sharplink providing strategic advisory services. The DeFi United framework, first outlined in an Aave DAO recovery proposal, combines protocol donations, credit lines, and treasury support into a unified approach for handling systemic collateral failures. Aave has warned that without this backing, the recovery process would be difficult to advance, as the attacker used the stolen 116,500 rsETH as collateral across Aave, Compound v3, and Euler to borrow an estimated $236 million in ETH and WETH, forcing protocols to pause markets and freeze user collateral.
According to crypto.XRP, the filing reveals details about the exploiter's position on Aave. The attacker supplied 89,567 rsETH as collateral and borrowed 82,650 WETH and 821 wstETH across Aave's Ethereum Core and Arbitrum V3 markets. Aave stated that its smart contracts were not compromised, presenting the incident as an external exploit affecting assets used across DeFi markets rather than a direct failure in Aave's lending system. LayerZero attributed the $293 million exploit to North Korea's Lazarus Group, specifically the TraderTraitor subunit, linking it to the Drift Protocol hack on April 1, bringing Lazarus-attributed DeFi losses to over $575 million in less than three weeks.
The freeze has sparked intense debate about Layer 2 network governance structures. Critics argue that a 9-of-12 multisig that can freeze any address is by definition a centralized control mechanism, regardless of how responsibly it's used. Charles Guillemet, CTO of Ledger, described the freeze as making visible governance structures that most users didn't realize existed. However, supporters point to the constitutional framework and law enforcement involvement, noting that Aave, SparkLend, and Fluid froze rsETH-related positions within hours of the exploit. The ARB token rose 3.24% on the news, while major DeFi protocols showed overwhelmingly supportive responses, though outside the immediate circle, reactions have been anything but unified.
According to crypto.XRP, the proposal includes an indemnification clause from Aave Labs covering the Arbitrum Foundation, Offchain Labs, and Security Council members. The frozen funds now sit in governance control, with the Arbitrum DAO must vote on what to do with them. The DeFi United coalition has already secured 14,570 ETH in pledges from ecosystem protocols such as EtherFi, Lido, and Ethena, while Mantle has extended a credit facility of up to 30,000 ETH. Aave DAO is separately considering a proposal to contribute 25,000 ETH from its own treasury, structured as an 'anchored' contribution that will not be scaled back even if further donations arrive. This governance vote will be closely watched because it sets the template for future freeze events, potentially validating the Security Council's emergency framework as a legitimate recovery tool or undermining arguments that governance can handle such situations responsibly.
