Approve Release of Frozen ETH

Authors: Aave Labs, KelpDAO, LayerZero, EtherFi, Compound Proposal Type: Constitutional AIP Date: April 25, 2026

Abstract Aave service providers are working with the KelpDAO team, LayerZero team, EtherFi, Compound, and other ecosystem parties on a recovery effort, with the goal of making affected rsETH holders whole. This proposal asks Arbitrum Governance to approve the release of the 30,765.67 ETH immobilized by the Arbitrum Security Council into that coordinated remediation effort. Those funds are intended to be applied toward making affected rsETH holders whole, with the goal of restoring rsETH’s backing.

This is proposed as a one-time measure given that the funds are already immobilized, the release destination is the sole remaining governance question, and releasing them to the ongoing coordinated recovery effort could make a significant positive impact.

Motivation On April 21, 2026, the Arbitrum Security Council froze 30,765.667501709008927568 ETH held by the exploiter on Arbitrum One and moved the funds to 0x0000000000000000000000000000000000000DA0. It was also stated publicly that a subsequent governance action is required to release those funds. Aave service providers are working with the KelpDAO team, LayerZero team, Compound team and other ecosystem parties on a recovery effort for rsETH holders. This proposal is intended to route already-secured funds into that coordinated recovery process.

This exploit has led to a deficit in rsETH’s backing. LlamaRisk’s April 20 incident report states that the KelpDAO rsETH Unichain-to-Ethereum route released 116,500 rsETH on Ethereum without a corresponding source-side burn, breaking the bridge invariant that Ethereum-side locked rsETH should cover remote-chain minted supply. At the time of the report, only 40,373 rsETH remained in the adapter as confirmed backing for 152,577 rsETH of remote-chain claims. The resulting backing shortfall is approximately 76,127 rsETH. The 30,765.67 ETH on Arbitrum represents a material contribution toward restoring that backing.

Across Aave’s Ethereum Core and Arbitrum markets, the exploiter supplied 89,567 rsETH to Aave and borrowed 82,650 WETH plus 821 wstETH against those positions. Note: Aave’s smart contracts were not compromised and the incident originated outside the protocol. Returning the frozen ETH to the recovery effort would directly reduce the outstanding impairment to rsETH’s backing, which in turn would reduce the impairment on the Aave V3 Arbitrum market and its users.

Increasing rsETH’s backing helps restore normal conditions for Arbitrum users, along with users across DeFi more broadly.

Rationale Arbitrum has publicly stated that a governance action is required to release the immobilized funds. The Arbitrum community and its users are directly affected by the rsETH incident, as are users across the broader DeFi ecosystem.

In line with this, our proposal asks Arbitrum DAO to release the recovered ETH into an ongoing, coordinated recovery effort involving the parties listed above and many others with the goal restoring the economic backing of rsETH.

Releasing the immobilized funds into this coordinated recovery effort is the best way to support affected users and provides a clear destination for the funds.

Key Terms Frozen ETH: The 30,765.667501709008927568 ETH frozen by the Arbitrum Security Council on April 21, 2026 and moved to 0x0000000000000000000000000000000000000DA0.

Designated recovery address: A 3-of-4 Gnosis Safe (SAFE) with signers from Aave Labs, KelpDAO, and Certora, and EtherFi, designated for the rsETH incident recovery effort and used solely to receive and apply recovered ETH toward that effort.

Recovery address: 0xf228130ce4fAB082C7D5522c90833cec83A9C15e

Recovered amount: The amount of ETH that Arbitrum governance authorizes for release under this proposal.

Final release amount: 30,765.67 ETH

Specifications This Constitutional AIP proposes the release of 30,765.67 ETH, the full frozen balance currently held at 0x0000000000000000000000000000000000000DA0, to 0xf228130ce4fAB082C7D5522c90833cec83A9C15e.

The recipient address will be a 3-of-4 Gnosis Safe with signers from Aave, KelpDAO, EtherFi, and Certora.

The released ETH is intended to be used solely for the remediation of losses arising from the exploit. If the coordinated recovery effort does not proceed as planned, the parties will return to Arbitrum Governance for further direction on the preferred use of funds.

Before onchain submission, authors of this proposal will update it with the final recipient address, the final ETH amount requested for release, and a short reconciliation appendix showing how the requested amount maps to the Arbitrum-side frozen balance and the intended remediation path.

Use of Funds The ETH is intended to be applied in a neutral and non-discriminatory manner toward restoring rsETH’s backing within the Kelp protocol. Every unit of ETH returned to the recovery effort narrows the backing shortfall and moves rsETH closer to full collateralization.

A full recovery would restore rsETH’s backing entirely, normalizing conditions for all rsETH holders, liquidity providers, and borrowers across Arbitrum and the rest of DeFi. A partial recovery would still meaningfully reduce the shortfall, improving the position of affected users proportionally and increasing the likelihood that the remaining gap can be closed through other contributions to the coordinated effort.

In either case, the outcome for Arbitrum users is better than leaving the funds frozen. The exploit created impairment for users on Arbitrum and across DeFi and every ETH returned to the recovery effort reduces that impairment directly.

Steps to Implement First, Aave Labs has published this Constitutional AIP on the Arbitrum forum for discussion and feedback.

Second, a Snapshot temperature check may be conducted to gauge delegate sentiment before moving onchain.

Third, if the proposal proceeds, it will be submitted onchain via Tally as a Constitutional AIP, targeting the Arbitrum Core governor, with the final executable action and recipient parameters.

Fourth, if the onchain vote passes, the proposal will proceed through Arbitrum’s Constitutional AIP lifecycle, including the applicable waiting periods, message finalization, and final execution.

Timeline Forum publication: immediate

Forum discussion: 1 week

Temperature check: 1 week

Onchain submission: after forum discussion and any temperature check, through the Arbitrum Core governor. Constitutional proposals are submitted through Arbitrum Core.

Voting delay: 3 days after onchain submission before voting begins.

Onchain vote: 14 days, extendable to 16 days if quorum is reached in the final 2 days.

L2 waiting period: 8 days for a Constitutional AIP.

L2-to-L1 message finalization: typically at least 1 week.

L1 waiting period: 3 days.

Execution: after completion of the Constitutional AIP lifecycle and any additional implementation steps.

Total estimated period: approximately 49 days

Overall Cost No new treasury allocation is requested.

This proposal concerns the release of ETH already frozen on Arbitrum One in connection with the exploit. The direct budgetary cost to Arbitrum DAO is therefore expected to be zero outside of normal governance execution overhead.

Requested Feedback Aave Labs requests feedback on whether Arbitrum Governance supports release of the frozen ETH into the coordinated rsETH recovery effort.

Conflict of Interest Disclosure Authors are submitting this proposal because they are affected by this incident, and because the requested release would benefit the ongoing coordinated recovery effort, releasing frozen proceeds to restore rsETH’s backing.

Indemnification As a condition of the requested release, Aave Labs, together with its affiliates, subsidiaries and successors-in-interest (collectively, “Aave Labs”), jointly and severally agree to unconditionally indemnify, defend, and hold harmless The Arbitrum Foundation, Offchain Labs, Inc., the Arbitrum Security Council and each member thereof and each of their officers, directors, agents, employees, advisors, contractors, representatives, and successors (each, an “Indemnified Party”) from and against any and all claims (including any claims brought by tokenholders, DAO participants, counterparties, or governmental authorities from any jurisdiction), regulatory inquiries, actions, demands, proceedings, losses, damages, fees, lost profit, tax, reduction in value, liabilities, costs, and expenses (including reasonable fees and expenses of lawyers, accountants, auditors, experts and other professionals), known and unknown claims, whether in contract, tort, criminal (to the fullest extent permitted by applicable law), or otherwise, directly or indirectly arising out of, arising from, resulting from or in connection with (1) the Arbitrum Security Council’s action to freeze the 30,766 ETH being held in the address on Arbitrum One that was connected to the KelpDAO exploit at the time of such action and its movement to a new address (“Frozen ETH”), (2) the release and movement of the Frozen ETH to the designated recovery address pursuant to this proposal (the “Delivery”), and (3) any and all actions of an Indemnified Party in furtherance of the actions described in clauses (1) and (2), in each case including enforcement actions, penalties, and reasonable defense costs related thereto (such amounts, collectively, “Indemnifiable Expenses”).

Promptly following the passage of this proposal, if applicable, and prior to initiating the Delivery, Aave Labs shall promptly enter into a customary Indemnification Agreement with each of the Arbitrum Foundation, Offchain Labs, Inc., and each member of the Arbitrum Security Council, which shall memorialize the terms set forth herein and shall further provide: (1) for advancement of all Indemnifiable Expenses within five business days of upon written request, (2) for contribution in the event that indemnification is unavailable to an Indemnified Party for any reason whatsoever, (3) that Aave Labs is the indemnitor of first resort (i.e., its obligations to the Indemnified Party are primary and any obligation of a third party to advance expenses or to provide indemnification for the Indemnifiable Expenses are secondary), (4) that each Indemnified Party shall have the right in its sole discretion to conduct the defense of and to settle or resolve any such claim, which shall be included as Indemnifiable Expenses; however, (i) Aave Labs shall have the right to initial notice from and reasonable consultation with the Indemnified Party on the status of any such claim, and (ii) Aave Labs shall have the right to advance notice of, and consent to, any resolution of such claim, which consent shall not be unreasonably withheld, (5) that this indemnification shall survive indefinitely and shall not be limited by the completion of the actions contemplated herein, the termination of this proposal, or the resignation or removal of any Indemnified Party, (6) that the indemnification obligations shall not be subject to any cap, basket, deductible, or limitation (either individually or in the aggregate with respect to the Indemnified Parties), (7) that indemnification shall apply to the fullest extent permitted by law, including claims alleging negligence, gross negligence, or breach of fiduciary duty (but excluding willful misconduct or fraud), (8) all amounts payable by Aave Labs under or in connection with the Indemnification Agreement shall be paid in full without any set-off or counterclaim and free and clear of any deductions or withholdings for any and all present or future taxes, levies, imposts, duties, charges, fees, deductions, or withholdings of any nature imposed by any governmental authority to the maximum extent allowed by applicable law; provided, however that such payments shall include any “gross up” that may be necessary to ensure that the Indemnified Party is economically whole on an after tax basis, (9) the rights of the Indemnified Parties pursuant to the Indemnification Agreement shall apply irrespective of, and shall not be reduced by, any insurance maintained by an Indemnified Party or any third party indemnitor, and (10) that the Indemnification Agreements contemplated herein shall be governed by and construed in accordance with the laws of the State of New York, without regard to conflict of laws principles, and in the case of any dispute resolution relating to this Agreement, Aave Labs hereby submits to the exclusive jurisdiction of the state and federal courts located in New York County, New York for such dispute resolution process, (11) solely with respect to The Arbitrum Foundation’s Indemnification Agreement, that Aave Labs shall reimburse the Arbitrum Foundation for any Indemnifiable Expenses incurred as a result of payment from The Arbitrum Captive Insurance Product (as further detailed at https://docs.arbitrum.foundation/assets/files/ArbitrumFoundationCaptiveInsuranceProduct-c149a557e210f00d0c457b10b367f58c.pdf) to ArbitrumDAO delegates as if such ArbitrumDAO delegate was an Indemnified Party and (12) the Indemnified Parties shall represent and warrant in their appliable Indemnification Agreement that, to their actual knowledge, they have not paid or become obligated to pay any cash amounts constituting Indemnifiable Expenses prior to the date of the first publication of this proposal that they intend to seek indemnification for pursuant to their Indemnification Agreement.