🔓 The Exploit That Shook DeFi Lending Markets
On April 18, an attacker exploited a critical vulnerability in Kelp DAO’s rsETH bridge, releasing approximately 116,500 unbacked rsETH tokens onto Ethereum without burning a corresponding amount on Unichain. The attack, which drained roughly $292 million in restaked ether, worked by forging inbound LayerZero packets that tricked Ethereum’s bridge adapter into releasing funds that had no real backing. The attacker then supplied around 89,567 of those tokens as collateral across Aave, Compound, and Euler, borrowing approximately $236 million in wrapped ETH and other assets against inflated positions. Blockchain forensics firm LayerZero and others quickly attributed the attack to North Korea’s Lazarus Group, a state-sponsored unit responsible for some of the largest crypto thefts in history, including the $1.46 billion Bybit hack in 2025. The attribution would soon open a legal front that nobody in DeFi had anticipated.
⚡ Arbitrum’s Security Council Freezes $71 Million Overnight
Just three days after the exploit, Arbitrum’s Security Council moved with unusual speed. On April 21, acting on input from law enforcement regarding the attacker’s identity, the Council used a 9-of-12 supermajority vote to freeze 30,766 ETH, worth approximately $71 million, that had been traced to exploiter-linked addresses on the Arbitrum network. The move was notable: recovering stolen crypto assets at the protocol governance level, without a court order, is rare. The Council confirmed the action did not disrupt ordinary users or applications running on Arbitrum. From there, the path to returning the funds appeared straightforward. An Arbitrum DAO snapshot vote showed 90.5% of delegates, representing 173.9 million ARB tokens, in favor of releasing the frozen ETH to DeFi United, the industry coalition leading the rsETH recovery. A final binding onchain governance vote was set to follow. Then lawyers arrived.
⚖️ Terrorism Creditors File a Restraining Notice
On May 1, attorneys from Gerstein Harrow LLP, representing U.S. families holding unpaid terrorism judgments against North Korea, served a restraining notice on Arbitrum DAO through the protocol’s governance forum. The legal action blocked any movement of the 30,766 ETH. The plaintiffs’ argument rested on the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, both of which allow creditors to attach assets tied to state sponsors of terrorism. Their theory: because Lazarus Group, an instrumentality of the DPRK, carried out the exploit, the frozen ETH constitutes North Korean state property subject to seizure. The three underlying judgments, Kim v. DPRK (approximately $330 million), Kaplan v. DPRK (approximately $169 million), and Calderon-Cardona v. DPRK ($378 million), carry a combined face value exceeding $877 million before post-judgment interest. DeFi investors suddenly found themselves watching a decade-old geopolitical dispute land inside a governance forum.
🏛️ Judge Garnett Finds a Middle Path
Aave LLC responded by filing an emergency motion in the Southern District of New York, asking Judge Margaret Garnett to vacate the restraining notice entirely or require the plaintiffs to post a $300 million bond. Aave’s legal team called the seizure theory legally flawed, arguing that a thief does not gain ownership of stolen property, and that freezing the funds risked cascading liquidations and irreversible harm to users who had no connection to North Korea or the exploit. Judge Garnett issued a two-page order taking neither side fully. She modified the restraining notice to allow an onchain governance vote transferring the ETH to a wallet controlled by Aave LLC, and shielded anyone who voted or participated in that transfer from liability under the freeze. The catch is significant: Aave LLC agreed to be bound by the restraining notice as if it had been served directly. That means if the court ultimately rules in favor of the terrorism creditors, Aave could be compelled to surrender the ETH it receives.
🤝 DeFi United Assembles the Industry’s Largest Recovery Fund
While the legal battle unfolded, DeFi United, the cross-protocol coalition formed in response to the exploit, continued assembling one of the largest voluntary recovery efforts crypto has ever seen. The 30,766 ETH from Arbitrum, if and when it arrives, would represent the single largest individual contribution to a fund that has raised over $320 million in total pledges. Other major contributions include 30,000 ETH from Consensys and Ethereum co-founder Joseph Lubin, a 30,000 ETH loan from Mantle DAO, and Aave’s own liquidation of the attacker’s remaining rsETH positions across its lending markets. The coalition includes Mantle, EtherFi, Golem, Lido DAO, Ethena, LayerZero, Ink Foundation, and others. Despite the scale of fundraising, rsETH’s backing shortfall still stands at approximately 76,127 rsETH, currently valued near $174.5 million, a reminder that voluntary recovery has its limits.
🎯 What Investors Should Watch From Here
This case sets a precedent that will matter far beyond Kelp DAO. For the first time, U.S. terrorism judgment creditors have established a legal claim that follows frozen crypto assets from one protocol to another, even as those assets move through DeFi governance processes. The restraining notice that was served on Arbitrum has now transferred to Aave LLC, and a further hearing, where the court would decide who actually owns the frozen ETH, has not yet been scheduled. For investors and DeFi participants, the near-term signal is that the industry’s coordinated recovery machinery is working. Aave’s liquidation of exploiter positions, Arbitrum’s emergency freeze, and the DeFi United fundraising coalition all performed as intended. The longer-term uncertainty is legal. Any protocol that receives, holds, or governance-votes on assets linked to a sanctioned state actor could find itself dragged into U.S. federal court. The intersection of DeFi governance and geopolitics just became a real compliance risk that protocol developers and DAOs can no longer afford to ignore.
Sources
https://www.theblock.co/post/400642/arbitrums-71-million-in-eth-cleared-for-aave-transfer-as-north-korea-terrorism-creditors-retain-legal-claim
https://www.coindesk.com/policy/2026/05/09/judge-clears-path-for-aave-to-move-usd71-million-in-eth-linked-to-north-korea-hack
https://www.mexc.com/news/1078176
https://www.cryptotimes.io/2026/05/01/arbitrum-dao-starts-vote-to-release-71m-in-frozen-eth-to-defi-united/
https://coinpedia.org/news/aave-recovers-exploited-rseth-funds-as-71m-eth-return-moves-forward/amp/
https://finance.yahoo.com/markets/crypto/articles/arbitrum-faces-restraining-order-north-024110089.html
https://unchainedcrypto.com/u-s-court-freezes-71-million-in-kelp-dao-eth-after-north-korea-terrorism-creditors-file-claim/
https://www.coindesk.com/policy/2026/05/05/defi-lender-aave-asks-court-to-block-usd71-million-crypto-seizure-tied-to-north-korea-claims
https://www.tradingview.com/news/cointelegraph:56fa8c4bc094b:0-arbitrum-vote-to-release-71m-in-frozen-kelp-exploit-eth-set-to-pass/
https://crypto.news/defi-united-plans-rseth-recovery-after-292-million-kelp-dao-exploit/
Crypto Club and Mode Mobile communications are for informational purposes only, and are not a recommendation, solicitation, or research report relating to any investment strategy, security, or digital asset. All investments involve risk including the loss of principal and past performance does not guarantee future results.
Any information contained in this commentary does not purport to be a complete description of the securities, markets, or developments referred to in this material. The information has been obtained from sources considered to be reliable, but we do not guarantee that the foregoing material is accurate or complete. There is no guarantee that any statements or opinions provided herein will prove to be correct.
Get fresh insights, breaking news, and hidden gems in the world of crypto—delivered straight to your inbox with our Crypto Cookies newsletter.
Don’t miss out—sign up now and get your first bite of insider knowledge!
