Aave Seeks to Lift $73M ETH Freeze From Kelp DAO Exploit

Aave LLC filed an emergency motion in federal court on May 1 seeking to lift a court-ordered freeze on roughly $73 million in ether recovered from the April 18 Kelp DAO exploit, arguing that temporary possession of stolen assets does not equate to ownership. The motion challenges restrictions preventing Arbitrum DAO from moving the recovered funds, as plaintiffs from separate years-old terrorism judgments against North Korea seek to claim them as restitution.

Challenge to Lazarus Group Attribution

Aave contested the legal claims underlying the freeze, stating they are based on unproven speculation that the Kelp DAO exploit was carried out by North Korean hacking outfit Lazarus Group. The filing emphasizes that even if such attribution were proven, stolen assets should not be treated as owned by those who temporarily possess them.

“A thief does not own what he steals,” Aave founder Stani Kulechov said in a statement, comparing the situation to a robber stealing diamonds from a jewelry store only to have them recovered by a bystander. “These funds belong to the affected users they were stolen from — full stop,” he added.

Details of the Kelp DAO Exploit and Recovery

The April 18 attack exploited a flaw in a cross-chain bridge tied to Kelp DAO’s rsETH token, using unbacked collateral to borrow around $230 million in ETH from Aave users. The Arbitrum protocol subsequently intercepted 30,766 ETH, now worth nearly $73 million, and set it aside for recovery. The recovered ETH was initially expected to be returned to victims as the first major pool of funds recovered after the exploit.

DeFi United Recovery Initiative

The recovery effort expanded into “DeFi United,” an industry-wide push that has since raised more than 137,700 ether worth nearly $327 million, pending the release of the frozen ETH and other protocol votes.

DeFi United raised funds. Source: DeFi United

Aave’s Legal Arguments and Bond Request

According to Aave’s filing, “The Immobilized Assets are funds that were taken from Aave Protocol users, not assets owned by any alleged wrongdoer.” Aave is asking the court to vacate the restraining notice or require the plaintiffs to post a bond of at least $300 million to cover potential damages if the freeze remains in place.