Court Approves Aave Recovery Plan for $71M Frozen in Lazarus-Linked KelpDAO Exploit

Highlights:

• The court approved the Aave recovery plan to transfer 30,766 frozen ETH through an Arbitrum governance vote.
• Judge Margaret Garnett allowed the ETH transfer while preserving terrorism creditors’ legal claims over the assets.
• Recovery teams plan to restore the rsETH backing and reopen withdrawals after the KelpDAO exploit.

A Manhattan federal judge approved a major step in the recovery of funds frozen after the Lazarus-linked KelpDAO exploit. Judge Margaret Garnett issued the ruling late Friday in response to disputes surrounding 30,766 ETH frozen on Arbitrum. The order permits Arbitrum DAO delegates to hold a binding onchain vote on transferring the ETH to Aave LLC. Judge Garnett also ruled that the restraining notice would remain attached to the ETH after transfer.

Advertisement

Update on the rsETH recovery.

Judge enabled the Arbitrum recovered funds to be moved to Aave LLC address.

Next steps of the recovery starts by backing the rsETH bridge.

ETH LTV moving back to normal.

Aave never stops fighting for the users and for DeFi.

DeFi United. https://t.co/cJbzEEvHkB

— Stani (@StaniKulechov) May 9, 2026

Attorney Charles Gerstein filed the restraining notice against Arbitrum DAO on May 1 on behalf of terrorism judgment creditors. Gerstein represents families holding about $877 million in unpaid judgments against North Korea. The plaintiffs argued that Lazarus Group conducted the exploit and connected the frozen ETH to DPRK-controlled activity. That filing threatened the coordinated recovery process involving Aave, KelpDAO, Certora, EtherFi, and Arbitrum DAO.

Judge Garnett modified the restraining notice instead of removing it completely. The ruling protects delegates, voters, and transfer participants from violating the restraining notice during the ETH transfer process. The order also permits Arbitrum DAO delegates to proceed with the recovery proposal through governance voting.

Aave Recovery Plan Faces Expanding DeFi Legal Pressure

Gerstein used the filing against Arbitrum DAO to pursue crypto assets allegedly linked to North Korea’s Lazarus Group. The plaintiffs argued that DeFi protocols should freeze funds once DPRK-linked wallets move stolen assets through their systems. That argument increased legal pressure on decentralized protocols connected to suspicious crypto transfers.

Arbitrum delegates previously supported the recovery proposal with more than 90% approval during an offchain Snapshot vote. However, the proposal still required a separate binding onchain vote before any transfer could happen. Judge Garnett’s ruling now allows Aave LLC and DeFi United coalition partners to continue the recovery process. Aave told the court that the frozen 30,766 ETH belonged to affected rsETH users and not Lazarus Group hackers.

Thanks to the 1,600+ addresses representing over 190 million ARB tokens who have voted on unfreezing the ETH related to the April 18 rsETH incident, currently held by the Arbitrum DAO.

Reaching quorum with a strong show of approval from delegates and the Arbitrum community is a… pic.twitter.com/mhIHH7iZ89

— Aave (@aave) May 6, 2026

The Arbitrum dispute also follows earlier lawsuits targeting DeFi protocols connected to alleged DPRK-linked fund movements, including Railgun DAO. Plaintiffs in those cases argued decentralized protocols should freeze suspicious assets instead of allowing further transfers.”

In January, terrorism judgment creditors filed a federal lawsuit against Railgun DAO over alleged DPRK-linked fund movements. The complaint accused Railgun DAO of allowing Lazarus-linked funds to move instead of freezing the assets for creditors. The lawsuit connected those allegations to earlier cyberattacks, including the $1.5 billion Bybit exploit.

rsETH Restoration Effort Moves Into Final Recovery Phase

Attackers exploited KelpDAO’s LayerZero bridge on April 18 after compromising its single-verifier bridge configuration. The attackers used compromised RPC nodes to submit false verification data and unlock about 116,500 rsETH from the Ethereum escrow. The exploit caused nearly $292 million in losses across the affected protocols.

After the exploit, DeFi protocols recorded temporary capital outflows estimated between $7 billion and $13 billion. Arbitrum’s Security Council froze 30,766 ETH linked to the exploit shortly after investigators traced the stolen funds. The freeze later became a major focus in the legal dispute involving North Korean-linked assets.

Liquidators closed eight exploiter-linked Aave V3 positions and transferred recovered rsETH collateral to the Recovery Guardian. Mantle DAO and Arbitrum DAO later passed governance proposals supporting the Aave recovery plan.

KelpDAO and coalition partners now plan to restore rsETH backing and reopen access to Ethereum withdrawals for affected holders. Recovery teams will burn liquidated rsETH on Arbitrum and retire the affected LayerZero packet tied to the exploit. KelpDAO plans to retire the affected LayerZero packet to prevent new rsETH minting through the compromised bridge route.

Aave, EtherFi, Certora, and other coalition partners will contribute ETH alongside recovered assets to fully back rsETH again. The coalition plans to combine those assets inside the Ethereum bridge lockbox before reopening withdrawals.

Advertisement