On Monday, April 21, 2026, Arbitrum's security council — a twelve-person council elected by the community — voted 9 to 3 and froze 30,766 ETH, equivalent to approximately $71.2 million, connected to the $293 million hack that devastated Kelp DAO the previous Saturday. The balance was transferred to a "frozen intermediary wallet" and can only be moved via a new council vote.
The news itself takes two lines. The discussion it opens lasts years. Because what Arbitrum did in practice was exercise sovereign asset-blocking power on a network that is marketed as "decentralized, permissionless and censorship-resistant". And what the community is beginning to realize — late, but with growing clarity — is that this narrative was always more slogan than technical reality.
The mechanics of freezing
It's worth understanding exactly what happened before discussing what it means. Arbitrum is a Layer 2 based on Ethereum that uses optimistic rollups: transactions are processed off-chain, aggregated into batches and posted to mainnet. Final security comes from Ethereum, but the order of transactions and management of "system" smart contracts are the responsibility of Offchain Labs and the Arbitrum Foundation.
The mechanism used in the freeze is not new — it's been documented since launch. The security council has emergency powers that include:
- Update system contracts without going through public governance;
- Pause the bridge between L1 and L2;
- Modify security parameters;
- Move specific funds in scenarios classified as emergency.
To trigger the freeze power, the council needs at least 9 of the 12 members. That's exactly what happened. Griff Green, a council member and well-known figure in the Ethereum ecosystem, published a statement saying the decision was not made lightly: "there were countless hours of technical, practical, ethical and political debate".
The funds were moved to an intermediary address from which they cannot be withdrawn — neither by the attacker nor by Arbitrum itself — without a new formal vote. In practice: it's an escrow controlled by a small, identified group supervised by the foundation.
Why the Kelp DAO hack went beyond a hack
To understand why the freeze was discussed with such seriousness, you need to remember the real scale of the Kelp damage:
- $293 million drained from the LayerZero cross-chain bridge;
- Stolen Kelp tokens were used as collateral to take out loans on Aave, creating uncollectable debt on one of the market's largest lending protocols;
- The attacker replicated the scheme on other connected protocols, spreading damage across the entire DeFi ecosystem;
- LayerZero publicly attributed the attack to actors linked to North Korea;
- In total, aggregate DeFi TVL fell $14 billion in 48 hours.
In this scenario, the security council's choice was between two evils. Option A: do nothing, let the attacker access the funds that moved through Arbitrum and watch the money turn to dust via mixers. Option B: freeze, accept the reputational cost in terms of "decentralization" and preserve what was still recoverable for potential victim compensation.
Nine members chose option B. Three disagreed.
The community reaction: the mirror of cognitive dissonance
It didn't take an hour for Twitter/X to explode. Arguments against centered on three axes:
- "If you can freeze the hacker's funds, you can freeze mine."
- "This is no different from a traditional bank."
- "The essence of crypto died today."
All three arguments have merit. But they also expose what we might call decentralization cognitive dissonance: the same community that celebrates when a foundation recovers stolen funds (Wormhole, Euler, Poly Network cases) is the one that revolts when the mechanism used for this is made explicit.
The council's defense — and those who supported the move — was more pragmatic: Arbitrum is not a pure blockchain, it's a rollup. A rollup depends on a set of trusted actors to operate (sequencer, proposer, council). Pretending otherwise is decentralization theater, to use the term gaining traction in recent academic literature.
The precedent isn't new — it was just exposed
Crypto claims "code is law" and practices "discretion is law". Some important precedents for context:
The DAO (2016)
When the TheDAO hack drained 3.6 million ETH in 2016, the Ethereum Foundation proposed and the community approved a hard fork that reversed the attacker's transactions. The chain that refused this intervention became Ethereum Classic. Today's Ethereum — trillion dollars in market cap — was born precisely from centralized intervention.
USDT / USDC (ongoing)
Tether and Circle freeze addresses every week. According to Chainalysis data, more than $1 billion in stablecoins were blocked in 2024 alone. No major philosophical discussion accompanies these freezes — because everyone knows, implicitly, that this is what allows stablecoins to operate in a regulated world.
Tornado Cash (2022)
The US OFAC sanctioned Tornado Cash mixer in August 2022. Circle immediately froze associated addresses. Infura and Alchemy blocked requests. The "censorship-resistant" proved quite sensitive to geopolitical pressure.
OpenSea, Binance, Coinbase
All these platforms freeze funds and delist assets routinely, either under court order or their own compliance decisions. The difference from Arbitrum is just that they are openly centralized companies.
Wormhole, Ronin, Euler
When Ronin was exploited for $625 million in 2022, Sky Mavis raised emergency capital to compensate users and adjusted the system. When Euler Finance was attacked in 2023, an off-chain negotiation ended with the hacker returning the funds. In all these cases, the human layer intervened. Code was not law.
The point Arbitrum illuminates: the spectrum of decentralization
Crypto operates on a spectrum of decentralization, not a binary. Simplified:
| Layer | Decentralization level | Who can intervene? |
|---|---|---|
| Bitcoin base layer | Very high | Practically no one |
| Ethereum base layer | High | Foundation via coordinated hard fork |
| Arbitrum / Optimism (rollups) | Medium | Security council (9 of 12 votes) |
| Solana | Medium | Validators and foundation (network pauses have occurred) |
| Stablecoins (USDT/USDC) | Low | Issuer, at any time |
| Centralized exchanges | Low | The company |
What Arbitrum's decision reveals is not technical novelty — it's a public admission. By using the power of the security council to freeze a hacker's funds, Arbitrum is saying, between the lines: "yes, we are a rollup, we are not Ethereum's mainnet, and we have — and have always had — the capacity to act".
Why regulators love this
From a regulatory standpoint, Arbitrum's decision is a demonstration of what MiCA, the new Brazilian BCB framework, FATF and FinCEN want to see happening. None of these regulators have ever believed — nor will ever believe — in "code is law" as an operating doctrine. What they demand, in summary, is:
- Existence of immediate freeze mechanisms when there is legal order or clear emergency;
- Capacity to assign responsibility to human actors;
- Cooperation with law enforcement agencies;
- Transparency about who has power and under what conditions it can be exercised.
Arbitrum's security council checked all the boxes. It's an identified group, with defined mandate, that voted publicly, with public justification, acting in recognized emergency. If Paris and Brussels needed to design the ideal scenario for rollup governance for MiCA purposes, it would look more or less like this.
Where the debate really goes
The relevant question is not "should it have frozen or not?". The practical answer is that yes, it's good that funds from State-nation attacks can be contained. The Kelp DAO attacker is not a curious teenager — it's probably a North Korean state hacking unit that uses stolen crypto to finance nuclear programs. The controversy in this specific case is weak.
The really important questions are different, and still unanswered:
- What's the limit? Will the security council freeze funds at the request of a country without due process? If a Venezuelan court demands blocking an opposition figure's funds, is the answer the same as for a North Korean attack?
- Who watches the watchers? The twelve council members are elected by token holders. But the largest token holders are professional investment funds. Real governance looks more like a corporation's board of directors than direct democracy.
- Does the precedent accelerate? Once done once, pressure to do it again — in increasingly subtle cases — only grows. It's a real slippery slope.
- Emergency fork as exit? Discontented communities can, in theory, fork the network. But Ethereum Classic shows the likely fate of these exits: residual relevance.
The reading for those operating in a regulated platform
For ON3X and other platforms operating under full regulatory framework — BCB in Brazil, CASP/MiCA in the European Union, VASP in other jurisdictions — Arbitrum's decision is confirmatory, not disruptive.
Three immediate readings:
- The "DeFi is safer because no one can touch it" pitch lost another nail. DeFi can be exploited for $293 million on a Saturday night, and when someone tries to salvage what's left, a council of twelve people shows up to hit the pause button. The pitch of "immutable and uncensored" sits poorly with this reality.
- Compliance stops being a competitive disadvantage. For a long time, regulated platforms were charged with "being like banks". With each episode like Arbitrum's, it becomes clearer that the difference between DeFi and regulated platform is increasingly less "whether there's human intervention" and increasingly more "whether intervention follows published rules or ad hoc rules".
- Integration with authorities is the new differentiator. Platforms that invested in relationships with the Federal Police, Coaf, Central Bank — and their counterparts in the EU and LATAM — can respond to incidents in hours, not days of council debate. When a victim seeks help, whoever knows which door to knock on wins.
At ON3X, we maintain mechanisms for immediate blocking, response to court orders, cooperation with regulatory agencies and — crucially — transparency about how these capabilities are exercised. It's not by accident. It's the model that regulators themselves, institutional investors and fraud victims are demanding, everywhere.
The final provocation
Arbitrum's $71 million freeze did not kill decentralization — it never was what the marketing promised. What the episode did was expose, publicly and documented, that there was always someone in charge. The "code is law" was, in large part, an aesthetic. The reality is that code + humans deciding when not to apply code = the actual operating model of most networks that matter.
Accepting this is not philosophical defeat. It's maturity. The challenge of the next decade is to design good systems of explicit governance — with clear rules, identified accountable parties, limits, audit, appeal process — instead of pretending they don't exist. Arbitrum made the first move. It will make the second, the third, the tenth. The industry as a whole will. And the sooner the debate shifts from "decentralization or not" to "what kind of governance do we want", the better for the end user and the ecosystem.