Arbitrum Bridge

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

APPROVED WITH LIMITS. Arbitrum’s canonical Nitro-based optimistic-rollup bridge has a clean exploit record on the bridge contracts themselves and a documented, non-theoretical emergency-response capability: on 2026-04-20, the 12-member Security Council froze about $71M in ETH linked to the Kelp DAO/LayerZero exploit, recovering roughly a quarter of the stolen value, then released it through a governance vote and federal court order once the legal process resolved. Non-emergency contract changes carry a real delay — roughly eleven days across an 8-day L2 and 3-day L1 window — a stronger structural check than Base’s zero-delay upgrade path, reviewed separately in this registry. The freeze episode cuts both ways: it protected users, but it also confirms 9 of 12 council members can unilaterally lock funds pending governance, a known and bounded concentration risk this cap prices rather than argues away.

Kill criteria: the events that revoke this verdict
• Any confirmed exploit of the native bridge contracts (Delayed Inbox, Outbox, Bridge.sol) as distinct from third-party bridges or DEXs built on Arbitrum
• Security Council threshold or membership changes without the required public transparency report
• An emergency action freezes funds without a subsequent governance vote and transparency report within a reasonable published window
• The seven-day withdrawal challenge period is shortened or bypassed for a class of users without equivalent public availability
• A second Security Council emergency freeze occurs without law-enforcement or judicial involvement comparable to the April 2026 precedent

The research file

Mechanism

Standard Nitro optimistic-rollup design. Deposits from Ethereum to Arbitrum are fast. Withdrawals are subject to a seven-day challenge period: the withdrawal is provisionally accepted while any party can submit a fraud proof, and funds are only claimable on Ethereum once the window closes without a successful challenge. This is structural to the rollup design, not a discretionary delay Arbitrum could shorten without changing its security model.

Control and governance

The Security Council is a 12-member multisig with two modes. Emergency Actions require 9-of-12 approval and can execute any action to protect chain integrity with no delay. Non-Emergency Actions also require 9-of-12 but must pass through the DAO’s AIP process, producing an 8-day L2 delay plus a 3-day L1 delay before deployment. Every emergency action requires a public transparency report afterward, and the DAO can remove Council members. This is a materially different structure from Base’s nested 2-of-2 operator-plus-council model with no delay on any upgrade path.

The April 2026 freeze: power exercised, not just documented

After the 2026-04-18 Kelp DAO/LayerZero exploit (reviewed separately in this registry’s `layerzero-v2` entry), the attacker used unbacked rsETH as Aave collateral to borrow about $230M in ETH. On 2026-04-20 the Security Council froze 30,766 ETH, about $71M, tied to the exploit, after consulting law enforcement, moving the funds beyond reach without a full governance vote. That recovered roughly a quarter of the total loss and is among the fastest such interventions on record. It also became entangled in a US federal court proceeding after parties tied to North Korea-related judgments sought a claim over the funds; Arbitrum delegates voted about 91% to approve release to an Aave-controlled recovery wallet, and a federal judge authorized the transfer on 2026-05-09. The native bridge contracts themselves were not exploited in this or any other identified incident; two July 2026 incidents sometimes associated with Arbitrum — the AFX Trade bridge hack and the Ostium oracle-key exploit — were confirmed to be third-party protocol failures unrelated to the canonical bridge.

Exit under stress

The seven-day challenge window applies uniformly with no officially expedited path; third-party liquidity bridges can front funds against a pending withdrawal faster, but carry a separate trust model and are out of scope for this canonical-bridge entry. A client relying on this bridge should plan around the full seven days for a guaranteed canonical exit, not assume same-day liquidity.

Comparison

Against Base’s canonical bridge (approved with limits in this registry): Base has zero delay on any upgrade once its 2-of-2 threshold is met, while Arbitrum’s non-emergency path carries a real, roughly eleven-day delay; both have a delay-free emergency path with a small elected group holding real unilateral power, and Arbitrum’s April 2026 freeze is direct evidence that power is exercised in practice, not theoretical. Neither is a reason to prefer one over the other outright — both carry the same class of governance-concentration risk, priced here at the same 15% cap.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Arbitrum Docs — bridge quickstart · primary · accessed 2026-08-17
  Supports: mechanism
• Arbitrum Foundation Support — why wait 7 days to claim funds · primary · accessed 2026-08-17
  Supports: challenge period rationale
• Arbitrum DAO Governance Docs — Security Council overview · primary · accessed 2026-08-17
  Supports: 9-of-12 emergency and non-emergency structure
• Arbitrum DAO Governance Docs — lifecycle and anatomy of an AIP · primary · accessed 2026-08-17
  Supports: AIP phases, upgrade delay
• CoinDesk — Arbitrum freezes $71 million in ether tied to Kelp DAO exploit · secondary · accessed 2026-08-17
  Supports: freeze event
• CoinDesk — Arbitrum delegates back $71M ETH recovery plan despite U.S. seizure fight · secondary · accessed 2026-08-17
  Supports: governance vote, legal dispute
• Crowdfund Insider — federal court authorizes Aave transfer of $71M ETH from Arbitrum · secondary · accessed 2026-08-17
  Supports: judicial resolution
• The Defiant — attacker drains $24M in USDC from AFX bridge on Arbitrum · secondary · accessed 2026-08-17
  Supports: native bridge unaffected

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.