Arbitrum’s decentralized governance system delivered a resounding verdict this week: release the frozen ETH and start paying back Kelp DAO victims. More than 90% of ARB token holders backed a proposal to unfreeze approximately 30,765 ETH — worth around $71 million — locked since the April 18 exploit that drained nearly $292 million from Kelp’s rsETH bridge.
The vote passed Friday with overwhelming support, but the actual transfer faces a complication few DeFi governance systems have encountered before: a United States federal court.
What the Governance Vote Approved
The proposal authorized the release of 30,765 ETH from Arbitrum’s Security Council freeze. Those funds would flow into a multi-signature wallet jointly controlled by Aave Labs, Kelp DAO, Certora, and EtherFi — a coalition assembled to manage the recovery and compensate affected users.
The multisig arrangement is designed to prevent any single party from unilaterally controlling the recovery funds, a precaution that comes directly from the governance community’s lessons learned about protocol-level accountability.
Once transferred, the funds would begin covering a portion of the outstanding rsETH shortfall. Even after the $71 million recovery, a gap remains: approximately 76,127 rsETH — currently valued at around $174.5 million — still has no backing. The April 18 attack wiped out far more than the frozen ETH can cover.
The Court Problem
Here’s where things get complicated. Aave LLC filed an emergency motion in US federal court to void a restraining notice that a separate claimant placed on the frozen ETH. The restraining notice — filed by a party seeking to recover damages through the US legal system — effectively blocked Arbitrum from moving the funds even after a governance vote authorized the release.
DAO governance operates on-chain. Court orders operate in the real world. When those two systems collide, there is no clear protocol to follow.
Arbitrum’s governance rules add another layer: even with the vote passed, any transfer is subject to an eight-day delay — a safety measure built into the protocol to allow time for legal or technical objections. That delay buys time for the court situation to resolve, but also means victims are still waiting.
North Korea’s Shadow
The Kelp DAO exploit has been widely attributed to Lazarus Group, the North Korea-linked hacking collective responsible for a string of high-value DeFi thefts over the past several years. The April 18 attack exploited a misconfiguration in Kelp’s rsETH bridge — which used a 1-of-1 DVN (Decentralized Verifier Network) setup on LayerZero rather than the recommended multi-DVN model.
The result was that a single point of failure allowed attackers to drain roughly $292 million worth of ETH wrapped across 20 different chains. The wrapped ether effectively became unbacked, as the bridge infrastructure collapsed under the exploit.
Arbitrum Also Eyes Yield Strategy
In a separate governance measure running in parallel, Arbitrum is also considering allocating 6,000 ETH from its treasury — approximately $14 million — into yield-generating DeFi strategies. The timing is notable: deploying treasury funds into yield at the same time the DAO is working to recover stolen ETH underscores the dual nature of DeFi governance right now — recovery and growth, simultaneously.
What This Means for DeFi Governance
The Kelp/Arbitrum situation is a stress test for decentralized governance at its most challenging. The DAO acted quickly, decisively, and with strong community consensus. But the interaction with US federal courts demonstrates that on-chain governance is not hermetically sealed from the traditional legal system — especially when hundreds of millions of dollars are at stake.
For institutional participants watching DeFi’s evolution, this episode cuts both ways: it shows governance mechanisms working as intended, while also highlighting the jurisdictional ambiguity that keeps many large capital allocators cautious.
FAQ
Q: What was the Arbitrum governance vote about?
A: Arbitrum DAO voted to release approximately 30,765 ETH ($71 million) frozen after the April 18 Kelp DAO exploit, transferring the funds to an Aave-led multisig wallet to begin compensating hack victims.
Q: Why haven’t the funds been transferred yet?
A: A US federal court restraining notice filed by a third-party claimant is blocking the transfer, despite the governance approval. Arbitrum’s protocol also imposes an eight-day delay after any governance vote.
Q: How much of the Kelp DAO hack losses will be covered?
A: The $71 million recovery covers only part of the damage. An additional ~$174.5 million shortfall in rsETH backing remains unaddressed.
