Arbitrum is facing one of the clearest tests yet of Layer 2 emergency powers after its Security Council froze 30,765.67 ETH linked to the KelpDAO rsETH exploit and moved the funds to a restricted address.
The official emergency action notice says the Security Council acted on April 21 and moved the exploiter-linked ETH to 0x0000000000000000000000000000000000000DA0. The action used a temporary inbox contract upgrade, added a sendUnsignedTransactionOverride function, impersonated the exploiter address through a cross-chain transaction, transferred the ETH, then returned the inbox implementation to its original version.
That technical path is why the story has exploded. Arbitrum’s own governance materials describe the Security Council as a 12-member body with a 9-of-12 emergency approval mechanism. In this case, the mechanism did not just pause a contract. It moved ETH from an address tied to the attacker without a prior DAO vote.
The follow-up vote is where the precedent gets sharper. Aave Labs, KelpDAO, LayerZero, EtherFi, and Compound submitted a Constitutional AIP asking Arbitrum governance to release the frozen 30,765.67 ETH into a coordinated rsETH recovery effort.
The proposal says the funds would go to a designated Gnosis Safe and be used to restore rsETH backing. It frames the move as a one-time action because the ETH is already immobilized and because the release destination is now the remaining governance question.
Aave said the proposal had moved to Snapshot voting, with the first phase intended to test community support before any longer on-chain governance process. The forum proposal estimates that full execution could take about 49 days if it advances through the Constitutional AIP lifecycle.
The Kelp exploit created a major rsETH backing shortfall. A LlamaRisk incident report said the attacker received 116,500 rsETH, deposited 89,567 rsETH into Aave, and borrowed 82,650 WETH plus 821 wstETH. The report also modeled a 15.12% uniform depeg scenario and said 119 user positions were simulated under that scenario.
That is where the public criticism has force, but needs precision. A viral governance critique claims the recovery favors major protocols over individual users. Root documents do not confirm every number in that post, including the exact count of liquidated users, but the concern is real: the AIP does not give a simple user-by-user payout schedule in its current form.
The proposal says released ETH would restore rsETH’s backing in a neutral and non-discriminatory manner. Critics argue that this may still make protocols and lending markets whole before ordinary users receive direct clarity. Some forum delegates have already asked for a clearer waterfall, public reporting, and explicit treatment for affected Arbitrum users.
The freeze likely protected tens of millions in exploited ETH, but it also showed how much emergency power still exists inside major rollups. That tradeoff now sits in front of Arbitrum governance: speed and recovery on one side, neutrality and user-level accountability on the other.
The same tension is appearing across DeFi security incidents. Users want stolen funds recovered, but they also want predictable rules before a small signer set can alter state during a crisis.
Arbitrum’s vote will not only decide the fate of 30,765 ETH. It will define how far L2 emergency powers can go after an external exploit, and whether future recovery plans must prove exactly who gets made whole before governance signs off.
The post Arbitrum’s $72M ETH Freeze Turns Kelp Rescue Into An L2 Power Test appeared first on Crypto Adventure.
