Aave Files Emergency Motion to Unfreeze $71 Million as North Korea Creditors Target Kelp DAO Recovery Funds
A US district court froze 30,766 ETH (~$71M) held by Arbitrum DAO after terrorism creditors invoked the Foreign Sovereign Immunities Act to attach recovery funds from the Lazarus Group's $292M Kelp DAO hack. Aave filed an emergency motion to unfreeze the assets.
Aave has filed an emergency motion asking a New York federal court to unfreeze approximately $71 million in Ethereum held by Arbitrum DAO — recovery funds recovered from the Lazarus Group's April 18 hack of Kelp DAO ($292 million stolen) — after families holding terrorism judgments against North Korea obtained a court restraining order attaching the recovered assets. The case is the first major test of whether a US court can attach DeFi protocol recovery funds to satisfy unrelated judgments against state-sponsored hackers.
The Freeze
The US District Court for the Southern District of New York issued a restraining order on May 1, barring Arbitrum DAO from moving the 30,766 ETH (~$71.1 million) that had been frozen on Arbitrum following the Kelp DAO exploit. The plaintiffs — families with unpaid terrorism judgments against North Korea — invoked the Foreign Sovereign Immunities Act (FSIA) and the Terrorism Risk Insurance Act (TRIA), arguing that because LayerZero attributed the April 18 hack to North Korea's Lazarus Group, the recovered ETH constitutes DPRK property and can be seized to satisfy existing terrorism judgments.
The Kelp DAO exploit itself was a sophisticated multi-step attack: the hacker exploited a vulnerability in a cross-chain bridge connected to the rsETH token, used the illicitly obtained assets as collateral on Aave to borrow approximately $230 million in ETH, then bridged the proceeds across multiple chains. A coalition of DeFi protocols — led by Aave, Kelp DAO, and LayerZero — assembled more than $311 million in pledges to fund recovery efforts, including 30,000 ETH from Consensys, 30,000 ETH from Mantle, and 5,000 ETH personally from Aave founder Stani Kulechov. The 30,766 ETH now frozen represents a significant portion of those recovery pledges.
The Legal Theory
Aave's emergency motion challenges the attachment on multiple grounds. The core argument: stolen and partially recovered crypto does not qualify as sovereign property under FSIA — the assets were stolen from private parties (Kelp DAO depositors), not owned by the DPRK. Aave further argues that attaching recovery funds for unrelated judgments would destroy the incentive structure for voluntary DeFi protocol recovery coalitions — if any recovered assets can be seized by parties with terrorism judgments, no protocol will ever voluntarily commit resources to recovery efforts again.
Aave asked the court to lift the restraining order entirely or, alternatively, to require the plaintiffs to post a bond of at least $300 million if the freeze remains in place — a number that reflects the full value of the recovery coalition's pledges, not just the frozen 30,766 ETH.
Unchained CryptoWhat's at Stake
This case will determine whether DeFi recovery coalitions are legally viable in the United States. The irony is precise: a voluntary protocol recovery effort — designed to make hack victims whole — becomes a target for terrorism creditors with a stronger legal claim. If the court validates the attachment theory, every future DeFi hack recovery will carry the risk of North Korea-adjacent asset seizure, since Lazarus Group is the dominant actor in large crypto thefts. The chilling effect on voluntary recovery would be severe. Watch for the SDNY ruling — it will define the legal landscape for on-chain asset recovery for years.
Track DeFi protocol moves and on-chain data daily — subscribe →
How we report: This article cites primary sources, regulatory filings, and on-chain data where available. BlockAI News uses AI tools to assist with research and first-draft generation; every article is reviewed and edited by a human editor before publication. Read our full How We Report page, Editorial Policy, AI Use Policy, and Corrections Policy.
