Aave fights court-ordered freeze of $73 million in ETH before US justice

The decentralized lending protocol Aave has filed an emergency motion before a US federal court to lift the freeze on $73 million in ether. This sum, currently blocked on the Arbitrum network, represents a portion of the funds recovered after the massive hack of the Kelp DAO protocol in April 2026. The central contention of the case opposes the direct victims of the exploitation to holders of anti-terrorism judgments seeking the assets to satisfy claims linked to North Korea. The outcome of this proceeding could establish a major precedent for the entire decentralized finance ecosystem

Context

On April 18, 2026, Kelp DAO, a liquid staking protocol operating primarily on Ethereum and Arbitrum, fell victim to an exploitation of its cross-chain gateway linked to the rsETH token. The attacker exploited a flaw in the LayerZero bridge system, the cross-chain messaging protocol widely used in the ecosystem, to divert approximately $290 million in ether. The scale of the incident makes it the largest hack to strike the decentralized finance sector since the start of 2026

The exploitation of Kelp DAO by the Lazarus Group represents a worrying development in the cyber threat landscape targeting the blockchain ecosystem. Unlike simple attacks targeting individual wallets, this operation exploited several layers of technical complexity by using cross-chain messaging mechanisms to launder and reuse stolen funds. Chainalysis, in its analysis of the incident, stressed that this type of exploitation requires continuous monitoring of inter-chain flows and invariant behavior verification systems. The company noted that the monitoring system watching for burn events on the source chain should have detected the anomaly created by the attacker

The method employed by the attackers illustrates a growing sophistication in attacks targeting decentralized finance. By exploiting a flaw in the LayerZero validation quorum, the attacker managed to release rsETH on the destination chain without burning corresponding tokens on the source chain. This « fake burn » technique made it possible to artificially create liquidity on Arbitrum, which was then used as collateral on Aave to finance other operations

A few days after the incident, the Arbitrum Security Council intervened to freeze 30,766 ETH, worth approximately $73 million, on a controlled address pending recovery proceedings. Without this rapid intervention, the funds could have been transferred to mixing platforms and laundered on other networks. This coordinated action preserved a significant portion of the assets that could be returned to victims

In parallel with the technical response, a coalition called « DeFi United » was formed to orchestrate the restitution of funds. This informal alliance brings together Aave, Kelp DAO, Lido, EtherFi as well as several other major players in the decentralized finance sector. The stated objective was to restore the collateralization ratio of rsETH holders, whose positions became undercollateralized after the exploitation. More than 137,700 ETH, or $327 million at the prices of the time, were raised in a few days to absorb losses and restore the parity of rsETH tokens with the underlying ether

At the governance level, Arbitrum DAO launched a vote procedure to authorize the transfer of frozen funds to a multi-signature wallet. This mechanism, supervised by the security firm Certora, was intended to allow controlled distribution to the victims of the exploitation. The proposal received overwhelming support from ARB token holders, hinting at a quick resolution of the crisis. However, a parallel judicial proceeding has since disrupted these plans

The Facts

On May 1, 2026, lawyers representing US citizens holding judgments against North Korea obtained a provisional freeze order from the Federal District Court for the Southern District of New York. These plaintiffs claim that the funds recovered by Arbitrum DAO are linked to activities of the Lazarus Group, the hacking collective attributed to Pyongyang by US intelligence services. Under US legislation allowing the seizure of assets connected to state-sponsored terrorism, they are demanding the transfer of funds to satisfy judgments obtained in anti-terrorism litigation

Their lawyers argue that the assets qualify as « property in which a terrorist party has an interest, » a legal qualification that would allow their seizure even if they are in the hands of uninvolved third parties. They acknowledge, however, that the accusations regarding North Korea’s involvement « could be valid, » while maintaining their freeze request

The choice of attorneys to specifically target funds deposited on Arbitrum rather than on other networks demonstrates a deliberate legal strategy. The Southern District of New York is renowned for its jurisprudence favorable to asset freeze requests in cryptocurrency cases, and the plaintiffs have apparently capitalized on this reputation to obtain the provisional measure. Their legal team, specialized in anti-terrorism litigation, has already obtained several significant judgments against North Korea in the past, giving them procedural credibility before US courts

On May 4, 2026, Aave LLC filed an emergency motion in response to this proceeding. The protocol, represented by its founder and CEO Stani Kulechov, advanced several legal arguments. First, the funds are « traceable proceeds of theft » — traceable products of theft — and not assets that can be claimed by third parties under anti-terrorism judgments. Second, the actual victims of the Kelp DAO exploitation deserve to be compensated first, not creditors whose claims date back to facts unrelated to the hack

The motion also details that the assets were seized directly from Aave smart contracts, meaning from third-party users who had no connection to the alleged illegal activities. The document specifies that Aave users « are completely unrelated to any alleged wrongdoing and have no known ties to North Korea. » The protocol is therefore asking the court to immediately lift the freeze, or failing that, to require the plaintiffs to post a $300 million bond to compensate for the potential harm caused by maintaining the freeze

Aave also highlighted the fact that the protocol users who provided the liquidity enabling the exploitation had no prior knowledge of the fraudulent origin of the funds. In an uncommon move for a company in the sector, the protocol published a detailed analysis of the incident, showing precisely how the collateral had been injected into the system by the attacker. This transparency contrasts with the attitude of many protocols that prefer to remain silent on security incidents to preserve their reputation

The jurisdictional battle also raises procedural questions. Aave challenges the legal qualification of Arbitrum DAO as an entity that can be sued under the notification rules used by the plaintiffs. The protocol refuses to be considered a traditional financial intermediary subject to the same legal obligations as a bank or regulated broker. This qualification could, however, be decisive in determining whether freeze measures can be enforced against DeFi protocols

Analysis

This case illustrates in a striking manner the growing tension between two logics of justice that oppose each other in the crypto ecosystem. On one side, on-chain governance mechanisms allow a rapid and coordinated response to security incidents, with decision timelines measured in days rather than years. On the other, the US state judicial system has binding but slower enforcement levers, which can intervene even when the DeFi community has already set up its own repair mechanisms

The question of jurisdiction arises with particular acuity in this case. Arbitrum DAO, as a community-governed protocol, does not correspond to any traditional legal category. Neither a company, nor an association, nor a trust, the Arbitrum Governance entity presents itself as a distributed decision-making system without a central counterpart. This legal ambiguity has been exploited by attorneys on both sides: plaintiffs have attempted to treat Arbitrum DAO as a traditional financial intermediary, while Aave challenges this qualification by pointing out the absence of any identifiable legal entity

Legal counsel Gabriel Shapiro pointed out that Arbitrum DAO is currently unable to manipulate Kelp DAO funds pending a divestiture hearing. This hearing, whose date has not yet been set, will determine whether the $73 million in ETH will go to the recovery fund set up by the DeFi United coalition or will be claimed by victims of anti-terrorism judgments. The burden of proof will notably rest on the plaintiffs’ ability to demonstrate the link between the frozen funds and the specific activities of the Lazarus Group

Beyond this specific case, this proceeding raises the question of the legal responsibility of decentralized protocols. By acting in a coordinated manner to freeze and recover funds, have DeFi actors created a precedent that could be used against them? Some observers fear that this « de facto centralization » could transform the legal perception of protocols, making them more vulnerable to traditional lawsuits. Others believe, on the contrary, that this response demonstrates the ecosystem’s capacity for self-regulation without resorting to state courts

The precedent created by this case could influence the way regulators approach DeFi protocols in the future. If courts recognize the ability of protocols to be sued in court and to have their assets frozen as part of anti-terrorism proceedings, this would open the way for increased sector surveillance. Conversely, if Aave’s arguments prevail, the ecosystem could benefit from a procedural immunity that would protect it from external interventions

The outcome of this proceeding could also influence the way DeFi protocols structure their governance and response frameworks. Legal experts consulted by several protocols believe that the ecosystem would benefit from developing more formalized incident response mechanisms, with clear protocols in place for managing recovered assets before any judicial intervention. These protocols should include notification procedures for stakeholders, internal contestation mechanisms, and fund distribution rules that could be opposed in subsequent prosecutions

Market Reactions

The market reacted with palpable nervousness to this major new security flaw in the DeFi ecosystem. The price of ether experienced a slight decline in the days following the announcement of the exploitation, in a context already tense due to macroeconomic concerns regarding interest rates and inflation in the United States. Exchange liquidation data revealed that short positions on ETH represented a significant portion of the liquidations recorded during this period, signaling that the market had taken directional bets on the aftermath of the incident

rsETH tokens logically suffered intense selling pressure immediately after the incident, with a significant discount compared to the value of the underlying ether. This discount was, however, largely absorbed thanks to the announcement of the restoration plan supported by the DeFi United coalition and the massive fundraise that accompanied it. rsETH holders who maintained their positions saw a large portion of their losses absorbed by the recapitalization mechanism put in place

Market participants are now closely following the outcome of the judicial proceedings, which could establish a precedent for the management of assets recovered after a DeFi hack. Some analysts believe that an unfavorable decision for DeFi protocols could lead to increased insurance premiums on leveraged positions, while a favorable decision would reinforce the credibility of on-chain governance mechanisms as an alternative to traditional litigation

Decentralized insurance platforms saw their activity increase significantly in the weeks following the incident, reflecting growing demand for protection against exploitation risks. Several protocols announced the establishment of additional reserve funds to deal with potential future attacks, while security audits of cross-chain gateways have become a prerequisite for any major new integration in the ecosystem

Perspectives

The divestiture hearing is of capital importance for the future recovery of Kelp DAO funds. If the court rules in Aave’s favor and lifts the freeze, the $73 million could be integrated into the compensation plan validated by the DeFi United coalition, allowing progressive compensation for the victims of the hack. The distribution process could then resume according to the terms approved by Arbitrum DAO, with technical supervision provided by Certora

Conversely, if the plaintiffs’ claims prevail, the funds could be allocated to the settlement of anti-terrorism judgments with no direct relation to the Kelp DAO exploitation. This outcome would be considered deeply unjust by a large portion of the DeFi community, which would see it as an instrumentalization of the US judicial system at the expense of the actual victims of computer crimes

The question of cooperation between DeFi protocols and judicial authorities could also become a major issue in the years to come. Some argue that the ecosystem should develop formalized judicial cooperation procedures, allowing authorities to obtain information about transactions and addresses involved in illegal activities without paralyzing protocol governance. Others believe that any form of cooperation with state authorities would be incompatible with the decentralization principles that found the very identity of decentralized finance

Possible resolution scenarios notably include an out-of-court agreement between the various parties, with a distribution of funds between the victims of the Kelp DAO exploitation and the holders of anti-terrorism judgments. Such an arrangement would, however, require the agreement of all parties, including Arbitrum DAO, which could be reluctant to assume a mediator role in this dispute. The intervention of the US Department of Justice, which has not yet taken a public position in this case, could also tip the balance one way or the other

Sources

• Aave moves to unfreeze $73 million in ETH as court battle complicates Kelp DAO recovery — MEXC News
• Aave challenges $71M freeze as DeFi recovery collides with North Korea claims — MEXC News
• Inside the KelpDAO Bridge Exploit — Chainalysis
• Aave fights court-ordered $73 million ETH freeze — Cryptocraft
• ETH Freeze Halts $73M Recovery — AInvest
• Aave Seeks Emergency Court Order — Binance Square