Aave says creditors are trying to seize stolen ETH before victims get their $71M back

A notable development has hit the crypto markets. Aave filed an emergency motion last week to free millions in frozen ETH from a restraining order issued against the Arbitrum DAO, turning what began as a coordinated exploit recovery into a court dispute. Aave LLC said the restraining notice was served on Arbitrum DAO on May 1 and seeks to seize approximately $71 million in ETH that Aave argues belongs to victims of the April 18 exploit. The company asked the court for an expedited hearing and a temporary vacatur, arguing that the recovered assets were designated for user restitution and should not be frozen for outside claims.

The ETH was frozen by Arbitrum's Security Council on Apr. 21, as Lazarus Group stole approximately 116,500 rsETH from Kelp DAO's LayerZero bridge three days earlier. The council used its 9-of-12 emergency powers to move 30,765 ETH without the attacker's key, designating it for a recovery pool.

Market Dynamics

24 funding update sized the original backing hole at 163,183 ETH. Between Kelp's own freeze, Arbitrum's action, and expected liquidations on Aave, the coalition closed about 52. 9% of that difference.

DeFi United assembled over $300 million in commitments for the rest, with Mantle contributing a credit facility of up to 30,000 ETH and Aave requesting 25,000 ETH from the treasury. The restraining notice, approved by a court in the Southern District of New York, targeted those frozen funds. The plaintiffs’ theory appears to rest on the alleged attribution of the exploit to Lazarus Group, the North Korean hacking operation, and on prior judgments tied to North Korea.

Aave’s motion challenges the leap from alleged attacker control to lawful ownership, arguing that stolen assets do not become attachable property simply because a thief briefly held them. The service plan included posting on Arbitrum's governance forum and mailing copies to the legal entities behind the Arbitrum DAO, Security Council members, and large ARB holders, with a warning that noncompliance could result in legal consequences for governance actors. A six-stage timeline traces the Kelp DAO exploit from the Apr.

Market Impact

18 attack through Aave's May 4 emergency motion to vacate a court restraint on 30,765 frozen ETH. The legal surface governance created The first argument in Aave's motion is that stolen assets do not become a thief's lawful property because the thief held them briefly, and the second is that Arbitrum DAO is not a juridical entity capable of service. That second argument lands on already-contested legal ground, as US courts have shown willingness to treat DAOs as general partnerships or suable collectives.

Lido DAO faced that treatment, building on earlier cases involving bZx and Compound -related litigation. Travers Smith's analysis of the Kelp episode noted that reachability centers on governance structure and demonstrated control, with Arbitrum's exposure rooted in its documented, exercised emergency-action mechanism. Arbitrum's forum delegates were already asking about indemnification spots, defense-cost advancement, and litigation exposure before Aave filed the motion.

That anxiety predates the court filing and points out that every protocol that establishes and uses emergency recovery powers also builds a documented control record that outside claimants can read. DeFi United's response proved that major protocols will override immutability when losses are large enough, and that capacity helped users while exposing governance levers that courts can try to reach. Once a governance body freezes, segregates, and publicly labels assets as recoverable, they become an identifiable pool that unrelated creditors can target, particularly where the attacker has documented links to a sanctioned state or judgment debtor.

Crypto markets are watching this development closely as investors weigh its potential impact on prices.