Arbitrum Security Council Freezes Funds Without Private Key, Evidence of Centralized Power on Blockchain?
Baca dalam 60 detik
- Dewan Keamanan Arbitrum menyita 74,5 juta token ARB dan 8.426 ETH dari alamat terkait eksploitasi Binance tanpa memerlukan private key pemilik.
- Aksi ini kedua kalinya setelah pembekuan serupa pada April, memicu diskusi tentang batas desentralisasi dan kekuasaan dewan dalam ekosistem Arbitrum.
- Kejadian ini menyoroti risiko konsentrasi kontrol di jaringan layer-2 dan implikasinya bagi investor serta pengembang di Indonesia yang mengandalkan Arbitrum.
The Arbitrum Security Council has once again demonstrated its ability to freeze crypto assets without the approval of the private key owner. On 30 October 2024, the council emptied an address reportedly linked to the Binance exchange exploit, seizing 74,559,805.2 ARB tokens and about 8,426 ETH. The action was taken just hours after Binance's hot wallet was drained, which according to the exchange resulted in losses of about $6.3 billion.
According to an explanation published by Zealynx on the Ethereum Magicians forum on 2 November, the Arbitrum Security Council used a contract upgrade mechanism to move the funds without requiring a cryptographic signature from the address owner. The process involved calling UpgradeExecutor through a single Ethereum transaction, which temporarily altered the Inbox code to record the target address as the message sender, then restored the original code after the message was relayed. This step was repeated for each asset, ARB first, followed by ETH.
On-chain data read by Unchained confirms that both messages were executed on Arbitrum One about 9 minutes 45 seconds after the Ethereum transaction, with transaction type 0x65 and an empty signature field. ARB was sent to a storage address ending in 0DA0, followed by 8,425.99768 ETH to the same address. Notably, the ARB token contract logs showed nothing unusual; to the contract and indexers, the transaction looked like an ordinary transfer made by the owner.
This is not the first time the Arbitrum Security Council has carried out a freeze. In April 2024, the same council moved more than 30,765 ETH held by the KelpDAO exploiter on Arbitrum One. Steven Goldfeder, co-founder and CEO of Offchain Labs, the developer of Arbitrum, in an interview with Unchained last July stressed that the council's role in the April action was designed that way. That power rests with a broadly elected "external entity," he said, and it is not he who holds that authority.
The fund freeze by the Arbitrum Security Council raises a fundamental question about the extent of decentralization in layer-2 networks. Although Arbitrum is promoted as a decentralized Ethereum scalability solution, the existence of a council with the power to move funds without private keys shows a centralized point of control. In its write-up, Zealynx said it saw no bug in the process, and stressed that the council used power granted by the DAO and published both actions within 1.5 hours. However, it highlighted the implications for developers: when a specification promises that only a key can move a wallet, on a chain like this that promise depends on who controls the upgrade path. On Arbitrum One, that path is held by the council's emergency Safe and the DAO timelock on Ethereum.
"That power rests with a broadly elected external entity, and it is not I who has the power to do that," said Steven Goldfeder, CEO of Offchain Labs.
For Indonesia, this case is an important mirror for regulators and domestic crypto industry players. Although Arbitrum is not the main network used in Indonesia, a similar principle applies: many blockchain projects claim decentralization but in practice have centralized emergency mechanisms. Investors and developers in the country need to understand that the promise that "only the key controls the funds" can collapse if a party controls the upgrade path. The Financial Services Authority (OJK), which now oversees crypto assets in Indonesia, can draw lessons on the need for governance transparency and audit mechanisms for blockchain projects operating in the domestic market.
Going forward, the debate over the balance between security and decentralization will intensify. ArbitrumDAO is scheduled to decide the fate of the frozen funds through a governance vote, which will be coordinated with relevant parties. Meanwhile, the global crypto community is waiting to see whether this council action will set a precedent for other layer-2 networks to do the same, or instead trigger a push to reduce centralized power. For users in Indonesia, the question arises: how far can we trust a network's claim of decentralization when the emergency button remains in the hands of a few?
