Judge clears Aave to move $71M in frozen ETH after Kelp DAO exploit

Why the ETH was frozen

The funds at issue are roughly 30,765 to 30,766 ETH tied to the April 18, 2026 Kelp DAO exploit, with reports valuing the stack at about $71 million to $73 million depending on timing ^[1][17][24]. Arbitrum's Security Council had immobilized or seized the ETH after the exploit, and Arbitrum delegates later approved a plan to release 30,765 ETH for a coordinated recovery effort with more than 90% support in the reported vote ^[5][4].

The frozen ETH represented only part of the loss. One report estimated the broader Kelp DAO exploit at about $292 million and said the frozen balance was roughly 24% of the amount taken ^[10]. Other reporting put the exploit around $290 million ^[5].

Why the court fight started

The transfer stalled after Gerstein Harrow LLP served a restraining notice on Arbitrum DAO, seeking to prevent movement of the recovered ETH ^[18][16]. The firm represented plaintiffs with unpaid judgments against North Korea; reports put those judgments at about or over $877 million ^{[1][13][16][18]}.

Their argument was that the frozen ETH could be treated as DPRK-linked property because the attackers were alleged to be connected to North Korean hacking activity, including Lazarus Group allegations ^[1][16][18]. Aave disputed that theory, arguing that the assets belonged to users harmed by the exploit, not to the alleged hackers or to North Korea ^[13]. Other reporting summarized Aave's position as saying theft does not confer ownership and that North Korea's role was alleged rather than settled for purposes of rerouting victim recovery funds ^[25].

How it fits Aave's recovery plan

Aave's emergency motion asked the Southern District of New York to vacate the restraining notice so the recovered ETH could be used for users affected by the April 18 exploit ^[1][17]. The judge's order gives that plan a legal path forward by allowing the ETH to move from Arbitrum into Aave-controlled recovery custody ^[8].

That custody step matters because the recovery plan depended on the recovered ETH being available rather than stuck between DAO governance and a U.S. court restraint. Arbitrum delegates had already backed releasing the funds for recovery, while Aave was arguing in court that the money should return to victims rather than be diverted to unrelated judgment creditors ^[4][13][18].

The recovered ETH also was not the whole backstop. Whale Alert reported that Joseph Lubin and ConsenSys pledged up to 30,000 ETH toward rsETH recovery, suggesting Aave's remediation effort included additional support beyond the frozen Arbitrum-held balance ^[1].

What the order does not decide

The ruling should not be confused with a completed payout or a final answer to every ownership question. Some coverage framed the result as a broader win for Aave over ownership, while reporting on the order itself emphasizes that legal claims remain protected ^[15][8].

Three caveats remain:

• The court order allows the transfer into Aave's control, but available reporting says competing claims remain preserved ^[8].
• The North Korea and Lazarus Group connection appears as an allegation in the legal dispute and reporting; Aave contests the idea that alleged attacker possession gives creditors a superior claim to the recovered ETH ^[1][18][25].
• Users still depend on the recovery process being executed after custody changes. Permission to move the ETH is a major step, but it is not the same as a completed restitution process ^[8][1].

Why this matters for DeFi

The episode shows how on-chain emergency response can collide with off-chain enforcement. Arbitrum governance approved releasing recovered ETH, but a U.S. court notice put that release in legal jeopardy until Aave obtained relief ^[4][16][8].

For DeFi protocols, the lesson is practical: freezing and recovering assets after an exploit may be only the first phase. Legal custody, creditor claims, and allegations around state-linked hacks can still determine how quickly recovered crypto can reach affected users ^[16][18][8].