[ARBITRUM] Approve Release of Frozen ETH

Authors: Aave Labs, KelpDAO, LayerZero, EtherFi, Compound Proposal Type: Constitutional AIP Date: April 25, 2026

Abstract Aave service providers are working with the KelpDAO team, LayerZero team, EtherFi, Compound, and other ecosystem parties on a recovery effort, with the goal of making affected rsETH holders whole. This proposal asks Arbitrum Governance to approve the release of the 30,765.67 ETH immobilized by the Arbitrum Security Council into that coordinated remediation effort. Those funds are intended to be applied toward making affected rsETH holders whole, with the goal of restoring rsETH’s backing.

This is proposed as a one-time measure given that the funds are already immobilized, the release destination is the sole remaining governance question, and releasing them to the ongoing coordinated recovery effort could make a significant positive impact.

Motivation On April 21, 2026, the Arbitrum Security Council froze 30,765.667501709008927568 ETH held by the exploiter on Arbitrum One and moved the funds to 0x0000000000000000000000000000000000000DA0. It was also stated publicly that a subsequent governance action is required to release those funds. Aave service providers are working with the KelpDAO team, LayerZero team, Compound team and other ecosystem parties on a recovery effort for rsETH holders. This proposal is intended to route already-secured funds into that coordinated recovery process.

This exploit has led to a deficit in rsETH’s backing. LlamaRisk’s April 20 incident report states that the KelpDAO rsETH Unichain-to-Ethereum route released 116,500 rsETH on Ethereum without a corresponding source-side burn, breaking the bridge invariant that Ethereum-side locked rsETH should cover remote-chain minted supply. At the time of the report, only 40,373 rsETH remained in the adapter as confirmed backing for 152,577 rsETH of remote-chain claims. The resulting backing shortfall is approximately 76,127 rsETH. The 30,765.67 ETH on Arbitrum represents a material contribution toward restoring that backing.

Across Aave’s Ethereum Core and Arbitrum markets, the exploiter supplied 89,567 rsETH to Aave and borrowed 82,650 WETH plus 821 wstETH against those positions. Note: Aave’s smart contracts were not compromised and the incident originated outside the protocol. Returning the frozen ETH to the recovery effort would directly reduce the outstanding impairment to rsETH’s backing, which in turn would reduce the impairment on the Aave V3 Arbitrum market and its users.

Increasing rsETH’s backing helps restore normal conditions for Arbitrum users, along with users across DeFi more broadly.

Rationale Arbitrum has publicly stated that a governance action is required to release the immobilized funds. The Arbitrum community and its users are directly affected by the rsETH incident, as are users across the broader DeFi ecosystem.

In line with this, our proposal asks Arbitrum DAO to release the recovered ETH into an ongoing, coordinated recovery effort involving the parties listed above and many others with the goal restoring the economic backing of rsETH.

Releasing the immobilized funds into this coordinated recovery effort is the best way to support affected users and provides a clear destination for the funds.

Key Terms Frozen ETH: The 30,765.667501709008927568 ETH frozen by the Arbitrum Security Council on April 21, 2026 and moved to 0x0000000000000000000000000000000000000DA0.

Designated recovery address: A 3-of-4 Gnosis Safe (SAFE) with signers from Aave Labs, KelpDAO, and Certora, and EtherFi, designated for the rsETH incident recovery effort and used solely to receive and apply recovered ETH toward that effort.

Recovery address: 0xf228130ce4fAB082C7D5522c90833cec83A9C15e

Recovered amount: The amount of ETH that Arbitrum governance authorizes for release under this proposal.

Final release amount: 30,765.67 ETH

Specifications This Constitutional AIP proposes the release of 30,765.67 ETH, the full frozen balance currently held at 0x0000000000000000000000000000000000000DA0, to 0xf228130ce4fAB082C7D5522c90833cec83A9C15e.

The recipient address will be a 3-of-4 Gnosis Safe with signers from Aave, KelpDAO, EtherFi, and Certora.

The released ETH is intended to be used solely for the remediation of losses arising from the exploit. If the coordinated recovery effort does not proceed as planned, the parties will return to Arbitrum Governance for further direction on the preferred use of funds.

Before onchain submission, authors of this proposal will update it with the final recipient address, the final ETH amount requested for release, and a short reconciliation appendix showing how the requested amount maps to the Arbitrum-side frozen balance and the intended remediation path.

Use of Funds The ETH is intended to be applied in a neutral and non-discriminatory manner toward restoring rsETH’s backing within the Kelp protocol. Every unit of ETH returned to the recovery effort narrows the backing shortfall and moves rsETH closer to full collateralization.

A full recovery would restore rsETH’s backing entirely, normalizing conditions for all rsETH holders, liquidity providers, and borrowers across Arbitrum and the rest of DeFi. A partial recovery would still meaningfully reduce the shortfall, improving the position of affected users proportionally and increasing the likelihood that the remaining gap can be closed through other contributions to the coordinated effort.

In either case, the outcome for Arbitrum users is better than leaving the funds frozen. The exploit created impairment for users on Arbitrum and across DeFi and every ETH returned to the recovery effort reduces that impairment directly.

Steps to Implement First, Aave Labs has published this Constitutional AIP on the Arbitrum forum for discussion and feedback.

Second, a Snapshot temperature check may be conducted to gauge delegate sentiment before moving onchain.

Third, if the proposal proceeds, it will be submitted onchain via Tally as a Constitutional AIP, targeting the Arbitrum Core governor, with the final executable action and recipient parameters.

Fourth, if the onchain vote passes, the proposal will proceed through Arbitrum’s Constitutional AIP lifecycle, including the applicable waiting periods, message finalization, and final execution.

Timeline Forum publication: immediate

Forum discussion: 1 week

Temperature check: 1 week

Onchain submission: after forum discussion and any temperature check, through the Arbitrum Core governor. Constitutional proposals are submitted through Arbitrum Core.

Voting delay: 3 days after onchain submission before voting begins.

Onchain vote: 14 days, extendable to 16 days if quorum is reached in the final 2 days.

L2 waiting period: 8 days for a Constitutional AIP.

L2-to-L1 message finalization: typically at least 1 week.

L1 waiting period: 3 days.

Execution: after completion of the Constitutional AIP lifecycle and any additional implementation steps.

Total estimated period: approximately 49 days

Overall Cost No new treasury allocation is requested.

This proposal concerns the release of ETH already frozen on Arbitrum One in connection with the exploit. The direct budgetary cost to Arbitrum DAO is therefore expected to be zero outside of normal governance execution overhead.

Requested Feedback Aave Labs requests feedback on whether Arbitrum Governance supports release of the frozen ETH into the coordinated rsETH recovery effort.

Conflict of Interest Disclosure Authors are submitting this proposal because they are affected by this incident, and because the requested release would benefit the ongoing coordinated recovery effort, releasing frozen proceeds to restore rsETH’s backing.

Indemnification As a condition of the requested release, Aave Labs, together with its affiliates, subsidiaries and successors-in-interest (collectively, “Aave Labs”), jointly and severally agree to unconditionally indemnify, defend, and hold harmless The Arbitrum Foundation, Offchain Labs, Inc., the Arbitrum Security Council and each member thereof and each of their officers, directors, agents, employees, advisors, contractors, representatives, and successors (each, an “Indemnified Party”) from and against any and all claims (including any claims brought by tokenholders, DAO participants, counterparties, or governmental authorities from any jurisdiction), regulatory inquiries, actions, demands, proceedings, losses, damages, fees, lost profit, tax, reduction in value, liabilities, costs, and expenses (including reasonable fees and expenses of lawyers, accountants, auditors, experts and other professionals), known and unknown claims, whether in contract, tort, criminal (to the fullest extent permitted by applicable law), or otherwise, directly or indirectly arising out of, arising from, resulting from or in connection with (1) the Arbitrum Security Council’s action to freeze the 30,766 ETH being held in the address on Arbitrum One that was

... please visit link below to view full proposal

https://snapshot.org/#/arbitrumfoundation.eth/proposal/0xb32581468bece42245fa267ea86156a621ae77f61bb866118189b5d50155b051