Terrorism victims holding $877 million in North Korea judgments are trying to seize $71 million in ETH stolen by Lazarus Group from Aave, arguing briefly stolen crypto becomes the thief's legal property.
Deep dive
- Aave filed Monday in Southern District of New York to vacate restraining notice served on Arbitrum DAO by lawyers for DPRK judgment creditors
- The frozen 30,765 ETH stems from April 2026 Kelp DAO exploit where attackers used forged message to mint 116,500 unbacked rsETH tokens on Arbitrum
- Attackers used the unbacked rsETH as collateral on Aave to withdraw approximately $230 million in ETH from the protocol
- Arbitrum Security Council froze the intercepted funds as part of coordinated recovery effort to return them to affected Aave users
- Three sets of judgment creditors hold $877 million in damages awards against North Korea from separate terrorism cases dating back decades
- Plaintiffs argue that because rsETH attackers are widely believed to be Lazarus Group (DPRK state actors), the recovered ether can be claimed against those judgments
- Aave's motion calls the Lazarus attribution "conjecture" based on unverified reports and argues even if true, thieves don't gain legal ownership by briefly possessing stolen property
- Aave warns keeping funds frozen "increases the likelihood of cascading liquidations, sustained liquidity outflows, and irreversible changes to user positions" in already-strained DeFi markets
- The filing seeks immediate lift of restraining notice or at minimum suspension while the case is heard
- Outcome could determine whether future crypto hack recovery efforts face interference from outside creditors seeking to garnish seized funds
- Core legal question: does temporarily holding stolen crypto during an exploit confer legal property rights that creditors can seize under existing federal judgments?
Decoder
- Garnishee: Legal term for a party holding property that belongs to a debtor, who may be ordered by a court to turn those assets over to the debtor's creditors
- rsETH: Kelp DAO's liquid restaking token on Ethereum, which became unbacked after the exploit allowed attackers to mint tokens without proper collateral
- Judgment creditor: Someone who has won a monetary judgment in court but has not yet collected the full amount, and is pursuing legal means to seize the debtor's assets
Original article
Aave filed in a New York federal court to lift a restraining notice blocking access to 30,765 ETH ($71 million) frozen after the April 18 Lazarus Group exploit of Kelp DAO's rsETH bridge, which used a forged message to mint 116,500 unbacked rsETH tokens on Arbitrum. A lawyer representing North Korean terrorism victims served Arbitrum DAO as a garnishee in three federal enforcement actions tied to $877 million in existing DPRK judgments, arguing the frozen ETH qualifies as North Korean state property under US law. Aave counters that the ETH belongs to innocent third parties and that brief attacker possession does not transfer legal ownership. The outcome could determine whether Lazarus Group exploits expose DeFi users' assets to federal garnishment under existing DPRK judgment enforcement frameworks.
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi