49 days to undo 46 minutes.

The Kelp DAO bridge exploit drained $292M of rsETH on April 18 in a 46-minute window between the first malicious cross-chain message and the emergency pause. Yesterday, April 25, a coalition of five protocols filed a Constitutional AIP on the Arbitrum forum requesting release of 30,765.667501709008927568 ETH currently frozen on Arbitrum One. The proposal documents its own end-to-end timeline: roughly forty-nine days, governed by a sequence of forum discussion, temperature check, on-chain vote, L2 waiting period, L1 finalization, and L1 waiting period.

Forty-nine days to do, on the recovery side, what nobody did at the action moment forty-six minutes earlier.

The recovery infrastructure is identity verification — just done very slowly, very expensively, after the funds are already gone.

292 milliseconds is a choice. $292 million is what happens when nobody chooses.

Two numbers worth holding next to each other

Lorica’s median warm-path verification time is 292 milliseconds. Kelp’s loss was $292 million. One of these numbers is a choice. The other is what happens when nobody chooses.

292ms — time to capture, verify, and sign a JWT proving a specific human authorized a specific action.
$292M — value released by an unverified cross-chain instruction in a 46-minute window.

Either you ask the identity question in the milliseconds before the action — or you reconstruct the answer in months after the fact, with five protocols, a 49-day governance vote, and an indemnity clause covering everyone who has to touch it. There is no third option that scales.

The asymmetry, on the same axis

If you draw the offense and the defense on the same axis, the chart does not draw to scale. Forty-six minutes is roughly 0.064% of forty-nine days. The attack is too small to render against the recovery without a logarithmic axis.

attack: 46 min
recovery: ~49 days

Same x-axis, same units. ~1,533× ratio between attacker speed and defender response. The defender response is not slow because anyone is failing at their job — it is slow because five independent organizations need to coordinate, vote, wait, and re-vote across two execution layers to do something a single attacker did with one valid cross-chain message. The mismatch is the architecture, not the people in it.

The 49-day path, as filed

The recovery process is not arbitrary delay. It is the visible cost of distributed trust, made legible. Every step exists because somebody, at some point, decided no single party should be able to release frozen funds unilaterally. The full sequence:

D 0 — Forum publication and structured discussion period (7 days). Delegates and security council members weigh in publicly.
D 7 — Snapshot temperature check (7 days). Non-binding signal from token holders before on-chain vote.
D 14 — Voting delay (3 days). Cooling-off window before the binding vote opens.
D 17 — On-chain governance vote on the Arbitrum Core governor (14 days). Submitted via Tally; quorum + supermajority required.
D 31 — L2 waiting period (8 days). Contractual delay between vote pass and execution authorization.
D 39 — L2-to-L1 message finalization (7 days). Cross-layer message clears the proof window.
D 46 — L1 waiting period (3 days). Final delay before the unfreeze transaction can execute.
D 49 — ETH released to 2-of-3 Gnosis Safe. Signers: Aave Labs, KelpDAO, Certora.

Every one of those steps is defensible in isolation. Together, they are an honest accounting of what it costs to recover stolen funds in a system whose foundational claim is that no single party should be trusted unilaterally. This is governance-as-defense doing the work that should have been done at the action moment forty-six minutes earlier.

The coalition is the news

The list of co-authors is itself the story. Five protocols who do not share a cap table, a multisig, or an executive team, forced onto the same legal document because nothing on-chain proved who pressed the button on April 18.

Aave Labs — holds the bad debt; up to $230M exposed.
KelpDAO — issued the broken token; 116,500 rsETH unbacked.
LayerZero — messaging layer below the bridge; 1-of-1 DVN failure mode.
Etherfi — adjacent restaking issuer; contagion-adjacent.
Compound — cross-protocol lender; blast-radius exposure.

None of these protocols had a prior shared signing relationship. The exploit did not just drain $292M in 46 minutes — it forced these five into a co-authored governance proposal, an indemnity clause, and a 2-of-3 Gnosis Safe with signers from three of them. The cost of not having an action-moment identity layer is not just the funds lost. It is the legal and operational coupling now permanently imposed on every protocol downstream of the failure.

Underwriters are reading this

The April 25 proposal includes an explicit indemnity clause — the five co-authors agree to indemnify the Arbitrum Foundation, Offchain Labs, the Arbitrum Security Council, and its individual members against claims arising from the freeze, the release, or related enforcement action. The fact that the indemnity exists tells you the legal exposure is real. The fact that all five protocols signed it tells you the legal exposure is shared. The fact that the proposal is on a public forum tells you crypto-native insurance underwriters are now reading post-incident governance traffic the same way traditional reinsurers read 10-K disclosures.

Marsh, Aon, Lockton, and the Lloyd’s syndicates writing crypto have all spent 2025 and early 2026 repricing renewals around exactly this failure mode: socially-engineered authorization of a privileged action, executing as designed, recovered (if at all) through expensive distributed governance. The third-party attestation question — can you produce a signed artifact proving a human authorized this transaction? — is moving from an interesting bonus on the underwriting checklist to a renewal-gating clause. Every coalition recovery proposal that gets indemnified by participating protocols is one more data point pricing that clause in.

The question that wasn’t asked

Every system the rsETH transaction passed through asked a question and got a correct answer. The cross-chain message was correctly formed. The verifier signature validated. The bridge contract executed as specified. None of those systems asked the question that would have stopped the chain.

The questions every layer answered, correctly, on April 18: “Is this cross-chain message well-formed? Is the DVN signature valid? Does the bridge contract recognize this instruction? Does the smart contract execute as specified given valid inputs?”

The question no layer answered — not at issuance, not at execution: “Is the human authorizing this cross-chain message, right now, the legitimate operator — and did they consent to this specific transfer, not just any transfer?”

The first set of questions is a code question. Smart-contract audits, formal verification, MPC threshold ceremonies — answer code questions. The second is an identity question. The industry has not productized an answer for it that lives at the moment of the action. So the answer is being reconstructed, after the fact, by five protocols and a 49-day governance vote.

What a centralized platform CISO does this week

Lorica today ships for centralized platforms — exchange withdrawals, OTC desks, stablecoin wires, card authorization inside a settlement window, beneficiary changes. The DeFi admin-operations version is adjacent architecture, not a drop-in product yet. But the chokepoint shape is the same. Every centralized platform has admin-equivalent operations that today verify a key, not a human. The Kelp recovery is the macro story. The micro story is that everyone reading this with a CISO title and a withdrawal endpoint is one socially-engineered signature away from the same shape.

5 things a CISO at a centralized exchange or fintech should do this week:

List your admin-equivalent chokepoints. Withdrawal approval, beneficiary change, key rotation, treasury wire, multi-sig signer change, large-trade authorization. Anywhere a privileged human signature moves money or changes who can move money.
For each chokepoint, ask: “what artifact proves a human authorized this, post-incident?” If the answer is “the signature itself,” the answer is wrong. A signature proves a key was used. It does not prove a human held the key at the moment of use.
Re-read your cyber liability and crime policy renewal terms. If your underwriter has not asked about transaction-moment human verification yet, they will at the next renewal. Crypto-native carriers (Evertas, Relm, Breach) and Lloyd’s syndicates writing crypto are already pricing this.
Add a “step-up at action” line item to your 2026 security roadmap. Not “MFA at login” — a separate, signed, replayable verification at the action moment. Keep it scoped: top three chokepoints by transaction value, not all of them.
Pilot the layer with one chokepoint. Lorica’s Sandbox access on signup fits below most procurement thresholds, ships in a single sitting, and produces a signed JWT your underwriter can audit. Live demo. Install. Or email tristan@loricaapi.com.

Drift was $285M on April 1. Kelp was $292M on April 18. Volo was $3.5M on April 22. April 25 was the first coalition recovery proposal. The pattern is not slowing down. 49 days to undo 46 minutes is the cost of the missing layer. Every protocol that pays it pays it because nobody asked the right question at the right time.