Arbitrum freezes 30,766 ETH

Arbitrum’s Security Council used an emergency power on April 21 to freeze 30,765.667501709008927568 ETH linked to the KelpDAO exploiter on Arbitrum One, according to an official post on the Arbitrum forum. The council said the funds were transferred to 0x0000000000000000000000000000000000000DA0 and can only be released through a later Arbitrum governance action. The move came after a broader rsETH incident that Aave service providers traced to April 18, when an attacker exploited Kelp’s LayerZero V2 Unichain-to-Ethereum route. Aave’s incident report said a forged inbound packet released 116,500 rsETH on Ethereum without a corresponding source-side burn, breaking the bridge’s backing assumptions. ### How did Arbitrum actually freeze the ETH? (forum.arbitrum.foundation) Arbitrum said the Security Council executed what it called an “atomic action” by temporarily upgrading the inbox contract on Ethereum, using a function called `sendUnsignedTransactionOverride`, impersonating the exploiter’s address in a cross-chain transaction, and transferring the ETH to the frozen wallet before restoring the original implementation. The forum post said council members verified and signed the transaction payload before execution. (governance.aave.com) That matters because the funds were not merely blacklisted inside an app. Arbitrum’s own post describes a chain-level intervention carried out through the Security Council’s emergency authority on Arbitrum One. ### What was the exploit that set this off? Aave’s April 20 incident report said the exploit began on April 18 at 17:35 UTC, when the attacker abused a Kelp rsETH bridge route configured as a 1-of-1 decentralized verifier network path. (forum.arbitrum.foundation) The report said Ethereum accepted a packet that looked structurally normal and released 116,500 rsETH even though no corresponding burn occurred on the Unichain side. Aave said the attacker then split the assets across seven addresses. Some of those addresses supplied rsETH as collateral on Aave V3 on Ethereum, some bridged funds to Arbitrum and opened Aave positions there, and several addresses ended up with active rsETH-backed loans whose health factors settled around 1.01 to 1.03. ### Why were Aave markets and LTV settings affected? (governance.aave.com) LlamaRisk said on April 19 that the Aave Guardian had already started freezing rsETH and wrsETH markets across deployments after being alerted to the exploit. Aave governance materials describe those freezes as stopping new supplying and borrowing and setting loan-to-value, or LTV, to zero to cut new collateral exposure. (governance.aave.com) The April 25 Arbitrum proposal said the exploiter had supplied 89,567 rsETH to Aave and borrowed 82,650 WETH plus 821 wstETH across Aave’s Ethereum Core and Arbitrum markets. The same proposal said Aave’s smart contracts were not compromised and that the incident originated outside the protocol. ### Why is the frozen amount important? (governance.aave.com) Aave Labs and other proposal authors said on April 25 that only 40,373 rsETH remained in the adapter as confirmed backing for 152,577 rsETH of remote-chain claims at the time of LlamaRisk’s report, leaving an estimated shortfall of about 76,127 rsETH. They described the 30,765.67 ETH frozen on Arbitrum as a “material contribution” toward restoring backing. (forum.arbitrum.foundation) Arbitrum’s forum post also made clear that the ETH is immobilized, not returned. The funds remain in the frozen address until governance decides where they go. ### Who decides what happens next? A constitutional AIP posted on April 25 by authors including Aave Labs, KelpDAO, LayerZero, EtherFi and Compound asked Arbitrum governance to approve release of the frozen ETH into a coordinated remediation effort aimed at making affected rsETH holders whole. (forum.arbitrum.foundation) The proposal says Arbitrum governance is now the body that must authorize any release. (forum.arbitrum.foundation) Arbitrum’s own emergency-action notice said the same thing in simpler terms: a subsequent governance action is required to release the funds. That makes the next concrete step an onchain or governance vote on the Arbitrum side, rather than another Security Council seizure. (forum.arbitrum.foundation 1) (forum.arbitrum.foundation 2)