Aave asks court to unfreeze $73M in ETH after Kelp DAO exploit

Aave filed an emergency motion on May 4 in the U.S. District Court for the Southern District of New York asking the court to lift a restraining order that froze about 30,766 ETH, roughly $73 million, recovered after an April 18 exploit of Kelp DAO’s rsETH token.

The April 18 incident involved an attacker who exploited a flaw in a cross-chain bridge to borrow about $230 million in ether from Aave users using unbacked collateral. Within days, the Arbitrum Security Council identified wallets linked to the attacker and moved 30,766 ETH into a controlled address.

On May 1, lawyers representing U.S. nationals with terrorism-related judgments against North Korea obtained a restraining notice that froze the recovered ether. The plaintiffs contend the assets qualify as “property in which a terrorist party has an interest,” citing alleged ties between the attacker and the Lazarus Group.

Aave says the funds are traceable proceeds of theft that belong to the users who lost money in the exploit. In its filing the protocol asked the court to lift the restraining order or require the plaintiffs to post a $300 million bond if the freeze stays in place. Aave founder Stani Kulechov wrote on X, “A thief does not own what he steals.”

The frozen ether is part of a broader recovery plan. Aave Labs, Kelp DAO, LayerZero and other partners formed a coalition called DeFi United and have raised more than 137,700 ETH, about $327 million, to restore backing for rsETH holders. That plan assumes release of the 30,766 ETH now held under the court order.

Before the restraining notice, Arbitrum DAO participants were voting to transfer the recovered funds into a multisignature wallet overseen by ecosystem stakeholders and security firm Certora. The vote is paused while the court order remains in effect.

A divestiture hearing in the Southern District of New York will determine control of the assets while the restraining order is in place. Legal observers note Arbitrum DAO cannot move the funds until the hearing.

Blockchain analysts report parts of the stolen ether continue to move on-chain as funds are routed through laundering channels and converted into stablecoins on other networks.

Aave asked the court to fast-track proceedings, arguing delays will hinder efforts to return funds to the users harmed by the exploit. The court will decide whether the victims’ claim to the recovered ether or the terrorism-related judgments take priority.