Arbitrum Security Council Invokes Emergency Powers to Move Attacker's ETH to Safe Address

CoinDesk reported that on April 21 (UTC+8), Dragonfly managing partner Haseeb Qureshi detailed an emergency intervention by the Arbitrum Security Council involving 30,765 ETH linked to the Kelp DAO attacker. The council used a technical mechanism to transfer the funds to a secure address and freeze them. Qureshi said the transaction was an ArbitrumUnsignedTxType (EIP-2718 type 0x65/101), a system-level transaction that cannot be signed by a standard externally owned account (EOA) and can only be injected into ArbOS by the Security Council. He emphasized the move did not require a chain rollback or any rewrite of historical blocks. In practice, it amounted to state-level recovery: the attacker's private key can still sign transactions, but the ETH at that address were moved by the chain itself. The episode also highlights the Security Council's powers in "catastrophic emergency" situations as outlined in Arbitrum's progressive decentralization documentation.