Aave Seeks Court Order to Unfreeze $73 Million in Ether From KelpDAO Exploit

TLDR

Aave LLC has filed an emergency motion in a U.S. federal court seeking to unfreeze roughly $73 million in Ether recovered after the KelpDAO exploit, arguing that the assets should be returned to affected users.

The motion was filed on May 4 in the U.S. District Court for the Southern District of New York. It challenges a May 1 restraining notice that blocks Arbitrum DAO from moving 30,766 ETH recovered after the April 18 exploit.

The frozen funds are now at the center of a dispute between DeFi users affected by the attack and plaintiffs holding terrorism-related judgments against North Korea. Those plaintiffs argue that the assets may be tied to the Lazarus Group, a hacking group widely linked by authorities to North Korea.

Aave disputes that position, saying the Lazarus attribution has not been proven and that stolen funds do not become the property of an alleged attacker. Aave founder Stani Kulechov said on X that “a thief does not own what he steals,” adding that the funds belong to users affected by the exploit.

KelpDAO Exploit Leads to Ether Recovery

The dispute began after an April 18 attack involving KelpDAO’s rsETH token, a liquid staking derivative tied to staked Ether. The attacker allegedly exploited a flaw in a cross-chain bridge and used unbacked collateral to borrow about $230 million in Ether from Aave users.

Soon after the attack, the Arbitrum Security Council identified wallets linked to the attacker and moved 30,766 ETH into a controlled address. The recovery was viewed as an early success in efforts to limit losses from the exploit.

Before the restraining notice, Arbitrum DAO participants had begun voting on a plan to move the recovered assets into a multi-signature wallet overseen by ecosystem stakeholders and security firm Certora.

That plan is now on hold. Legal observers said Arbitrum DAO cannot move the funds while the court order remains active.

Terrorism Judgment Plaintiffs Seek Claim

The restraining notice was obtained by lawyers representing U.S. nationals with terrorism-related claims against North Korea. Their argument is based on the claim that the KelpDAO exploit may have involved the Lazarus Group.

The plaintiffs say the recovered Ether could qualify as property in which a terrorist party has an interest. They are seeking access to the funds under laws that allow victims of state-sponsored terrorism to pursue compensation.

Aave said the legal theory would redirect stolen assets away from the users who lost funds in the exploit. In its filing, the company described the frozen Ether as traceable proceeds of theft rather than property owned by any alleged wrongdoer.

Aave is asking the court to vacate the restraining notice. As an alternative, it requested that the plaintiffs be required to post a bond of at least $300 million if the freeze remains in place.

DeFi United Recovery Plan Faces Delay

The frozen Ether is part of a wider recovery effort involving Aave Labs, KelpDAO, LayerZero and other ecosystem participants. The coalition, known as DeFi United, has raised more than 137,700 ETH, worth about $327 million, to help restore backing for rsETH holders.

The release of the 30,766 ETH is a key part of that recovery plan. Without access to the frozen assets, the process remains delayed while the court considers competing claims.

The case also raises questions about how courts may treat DAO-controlled assets when decentralized systems coordinate to freeze or recover funds.

A forthcoming hearing is expected to determine who can control the recovered Ether. Until then, the assets remain frozen amid claims from victims of exploitation and plaintiffs seeking restitution tied to North Korea-related judgments.