Aave moves to unfreeze $73 million in ETH as court battle complicates Kelp DAO recovery

Aave LLC is asking a U.S. federal court to lift a restraining order that has frozen roughly $73 million in Ether  (ETH) recovered after the Kelp DAO exploit.

In an emergency motion filed on May 4 in the U.S. District Court for the Southern District of New York, the lending protocol said the funds should go back to users who lost money in the attack, not be held to satisfy unrelated terrorism judgments.

From exploit to courtroom

The dispute traces back to an April 18 exploit involving Kelp DAO’s rsETH token, a liquid staking derivative representing staked ether. An attacker allegedly abused a flaw in a cross-chain bridge, a system that allows assets to move between blockchains, to borrow around $230 million in ether from Aave users using unbacked collateral.

Within days, the Arbitrum Security Council stepped in, identifying wallets tied to the attacker and moving 30,766 ether into a controlled address. The recovery was seen as a rare early win in a sector where stolen funds are often difficult to claw back.

But that momentum stalled on May 1.

Lawyers representing U.S. nationals with terrorism-related claims against North Korea secured a restraining notice that effectively froze the recovered funds, Cryptopolitan reported. Their argument hinges on the alleged involvement of the Lazarus Group—a hacking collective widely linked by authorities to Pyongyang.

In court filings, the plaintiffs said the crypto assets qualify as “property in which a terrorist party has an interest,” opening the door for seizure under U.S. laws designed to compensate victims of state-sponsored terrorism.

Aave pushes back

Aave argues that reasoning goes too far.

While the platform acknowledges the seriousness of the claims, it says the legal theory risks redirecting stolen funds away from the actual victims of the exploit. It also disputes whether the Lazarus Group attribution has been definitively proven.

“A thief does not own what he steals,” Stani Kulechov said in a post on X on May 4. “These funds belong to the affected users they were stolen from.”

In its filing, Aave described the frozen assets as “traceable proceeds of theft,” and urged the court to either lift the order or require the plaintiffs to post a $300 million bond if the freeze remains in place.

Recovery effort in limbo

The frozen ether sits at the heart of a broader industry response. Aave Labs and partners, including Kelp DAO, LayerZero, and others, formed a coalition—dubbed “DeFi United”—to stabilize the ecosystem after the attack.

So far, the group has raised more than 137,700 ether, worth about $327 million, to help restore backing for rsETH holders. But the recovery plan assumes the release of the seized 30,766 ether now caught in legal limbo.

Before the court order, Arbitrum DAO participants had already begun voting to transfer the funds into a multi-signature wallet overseen by ecosystem stakeholders and security firm Certora. The proposal drew overwhelming support—but it is now effectively on hold.

Legal observers say the DAO has little room to act independently while the order is in force.

“Arbitrum DAO is not allowed to do anything with the KelpDAO funds for now, until a divestiture hearing,” said Gabriel Shapiro in a post on X.

A broader legal test for DeFi

At its core, the case highlights a growing tension: when decentralized systems take coordinated action, such as freezing funds, do they begin to resemble traditional financial intermediaries in the eyes of the law?

A forthcoming divestiture hearing will decide who ultimately controls the assets. Until then, the funds remain frozen, caught between two competing claims: victims of a crypto exploit and creditors seeking compensation for acts of state-sponsored terrorism.

The outcome could shape how courts treat DAO-governed assets in future disputes, particularly when those assets are secured or immobilized through collective action.

Meanwhile, parts of the stolen ether remain in motion elsewhere, with blockchain analysts tracking funds as they are routed through laundering channels and converted into stablecoins on other networks.

For Aave and its users, the priority is speed. The protocol has asked the court to fast-track proceedings, warning that delays could weaken efforts to make victims whole.

Still letting the bank keep the best part? Watch our free video on being your own bank.