TLDR
A U.S. judge has allowed $71 million in Ether tied to a high profile DeFi exploit to be moved into Aaves control for recovery.
- Judge Margaret Garnett modified a restraining order so Arbitrum maker/">DAO can transfer about 30,765 ETH (around $71 million) from a frozen address to an Aave controlled wallet.
- The funds come from an rsETH/KelpDAO exploit linked to North Korea, and are central to recapitalizing rsETH and normalizing Aaves Ethereum markets.
- Terrorism victims still have a legal claim on the ETH, so Aave cannot treat it as fully theirs and future court rulings could redirect the assets.
Deep Dive
1. What The Judge Actually Approved
Multiple reports confirm that Manhattan federal judge Margaret Garnett has modified a prior restraining notice to let Arbitrum DAO move roughly 30,765 ETH, worth about $71 million, to a wallet controlled by Aave LLC as part of a recovery plan for a North Korea linked exploit on Arbitrum. The order allows an onchain governance vote to execute the transfer and explicitly shields those who initiate or vote on the transaction from violating the freeze that previously applied to Arbitrum DAO governance participants here.
According to detailed coverage, the ETH was frozen by the Arbitrum Security Council after the April KelpDAO rsETH bridge exploit, where attackers used unbacked rsETH as collateral on Aave V3 to borrow around $230 million in ETH here. Attribution efforts have linked the attack to North Korea connected Lazarus Group, drawing in terrorism judgment creditors.
2. Impact On Aave, rsETH And DeFi
The 30,765 ETH is the largest single piece of a broader multi protocol recovery effort to restore full backing for rsETH and cover bad debt on Aave. Aaves own communications and external reporting describe this as one of DeFis most complex coordinated recoveries, involving Arbitrum DAO, KelpDAO, Mantle, DeFi United and others here.
With the court now permitting the transfer, Aave can use the released ETH to recapitalize the rsETH bridge and bring rsETH back toward a 1:1 backing with ETH, which in turn lets Aave normalize loan to value parameters on its ETH markets and reduce systemic risk from the exploit. Aave has already liquidated attacker positions and started burning inflated rsETH supply as part of this process here.
For users of Aave and rsETH, this materially improves the chances of a clean recapitalization and more normal collateral settings, which reduces tail risk around this particular exploit.
3. Legal Cloud And Remaining Risks
Crucially, the judge did not resolve who ultimately owns the ETH. The restraining notice and the terrorism creditors claims follow the assets as they move to Aaves wallet, meaning Aave cannot treat the funds as unencumbered and may need to hand them over if the creditors ultimately win in court here.
Lawyers representing families with roughly $877 million in unpaid terrorism judgments against North Korea argue that the exploited ETH is North Korean property that can be seized to satisfy those judgments here. A final ruling on ownership has not been scheduled, and the case is part of a broader push to attach North Korea linked crypto assets, including separate actions against Railgun DAO.
The immediate operational risk for onchain governance participants is reduced, but legal outcome risk remains on the funds themselves, underscoring how DeFi recovery efforts are increasingly entangled with traditional courts and sanctions law.
Conclusion
Aave winning court permission to move $71 million in frozen ETH is a major step toward cleaning up the rsETH/KelpDAO exploit and stabilizing its ETH markets, but it is not the end of the story. The ETH now sits in an Aave controlled wallet under a legal cloud, with terrorism creditors still pressing their claims, so the real long term precedent will depend on how U.S. courts ultimately balance hacked DeFi funds against sanctions and judgment enforcement priorities.
