Aave Challenges $73M ETH Freeze in Court Over Kelp DAO Exploit

Aave LLC filed an emergency motion in federal court on May 1 seeking to lift an order that froze roughly $73 million in ether tied to last month’s Kelp DAO exploit, according to the filing. The motion challenges restrictions on Arbitrum DAO moving the recovered funds while plaintiffs from separate years-old terrorism judgments against North Korea seek to claim them as restitution.

Aave argued that claims linking the exploit to North Korean hacking outfit Lazarus Group are based on unproven speculation. The protocol further contended that even if the connection were proven, temporary possession of stolen assets does not equate to ownership.

“A thief does not own what he steals,” Aave founder Stani Kulechov said in a statement, comparing the situation to a robber stealing diamonds from a jewelry store only to have them recovered by a bystander. “These funds belong to the affected users they were stolen from — full stop,” he added.

Technical Details of the Kelp DAO Exploit

The attack on April 18 saw a bad actor exploit a flaw in a cross-chain bridge tied to Kelp DAO’s rsETH token, using unbacked collateral to borrow around $230 million in ETH from Aave users, according to the source material.

Shortly after the exploit, the Arbitrum protocol intercepted 30,766 ETH, now worth nearly $73 million, and set it aside for recovery. The recovered ETH was initially expected to be returned to victims as the first major pool of funds recovered after the exploit.

DeFi Recovery Efforts

The recovery effort expanded into “DeFi United,” an industry-wide push that has since raised more than 137,700 ether worth nearly $327 million, pending the release of the frozen ETH and other protocol votes.

DeFi United recovery initiative tracker. Source: DeFi United

“The Immobilized Assets are funds that were taken from Aave Protocol users, not assets owned by any alleged wrongdoer,” the filing states.

Aave’s Legal Request

Aave is asking the court to vacate the restraining notice or require the plaintiffs to post a bond of at least $300 million to cover potential damages if the freeze remains in place.