The Arbitrum Security Council has taken emergency action to freeze 30,766 ETH held in an address on Arbitrum One linked to last week's KelpDAO exploit. At ETH's current price of $2,313 (as of April 21, 2026), the frozen pile is worth roughly $71.1 million. The disclosure came via WuBlockchain on X around 03:51 UTC.
This is one of the more visible interventions the Council has executed since it was established as part of Arbitrum's governance design, and it lands while the broader DeFi ecosystem is still digesting what the KelpDAO bridge breach means for restaking-collateralised lending markets.
What the Council Actually Did
Arbitrum's Security Council is a 12-member multisig with the authority to push emergency upgrades to the Arbitrum One and Arbitrum Nova chains without going through the standard 30-day governance vote. Nine of twelve members must sign for an emergency action to clear. The freeze on the KelpDAO-linked address means the wallet can no longer move the ETH on Arbitrum One until further governance steps are taken.
The Council is intentionally hard to use. It exists for cases where waiting weeks for a normal proposal would let attackers cash out, and most of its activity to date has been routine technical patches rather than freezing user funds. A freeze of this size, on funds tied to an active investigation, is the sharper end of what the Council was designed for.
How the ETH Got There
The 30,766 ETH originates from the KelpDAO bridge exploit covered earlier this week, in which roughly $292 million was drained from a LayerZero bridge contract used to route rsETH between chains. Portions of the stolen funds were pushed across networks. The Arbitrum One slice is what the Council just locked down.
KelpDAO has been one of the louder restaking ecosystems built around EigenLayer, and rsETH was a meaningful collateral asset on Aave's V3 and V4 deployments before Aave froze the relevant markets. AAVE itself fell roughly 22% as whales rotated out and on-chain TVL dropped by about $6 billion in the days after the breach.
The Council action does not recover the funds for users. It only prevents this specific tranche from being moved on Arbitrum One. Bridging routes, mixers, and off-ramp paths on other chains remain a separate problem. But for the portion that ended up on Arbitrum, the attacker now has to wait for the Council to either approve a return path or coordinate with law enforcement.
Why a Layer 2 Council Can Do This at All
Most Ethereum users assume that once a wallet has assets, no party can stop them from being moved. That assumption holds on Ethereum mainnet. It does not hold the same way on rollups during their training-wheels phase.
Arbitrum One is governed by a smart-contract system whose upgrade keys sit with the Security Council during emergencies and the DAO during normal operation. A freeze is implemented by upgrading the relevant contracts so that the targeted address cannot transfer. It is, in effect, a temporary censorship action approved by a supermajority of a known group of signers.
That tradeoff is on the box. Arbitrum's documentation has always described the Council as an explicit centralisation tradeoff during the path to full decentralisation. Today's action is a live demonstration of why that tradeoff exists, and it will sharpen the longer-running debate about when L2 governance should and should not intervene in the movement of user-controlled funds.
What to Watch Next
Three things matter from here. First, whether the Council coordinates with KelpDAO and the wider rsETH community on a path to return any of the frozen ETH to depositors who took losses on the original exploit. Second, whether parts of the stolen pool that landed on other chains see similar interventions or simply get bridged out. Third, whether this freeze becomes a template that other rollups copy for their own emergency response playbooks, or stays a one-off response to a particularly clean on-chain trail.
Aave's posture is also worth watching. The protocol has said publicly that rsETH remains fully backed but has kept its V3 and V4 markets frozen. Council action of this scale could give Aave governance more comfort to revisit those market parameters, though no proposal to do so has appeared yet.
Overview
The Arbitrum Security Council froze 30,766 ETH (roughly $71 million at $2,313 per ETH on April 21, 2026) sitting in an address tied to the KelpDAO exploit. The action was executed under the Council's emergency powers and prevents the funds from moving on Arbitrum One until further governance steps are taken. It is one of the larger interventions the Council has performed and a real-time test of how Layer 2 governance responds to the fallout from one of 2026's biggest DeFi breaches.
