DeFi lender Aave and other stakeholders impacted by last month's Kelp DAO hack have launched a binding Arbitrum governance vote to transfer $71 million in disputed ether into an Aave LLC-controlled address. The Constitutional Arbitrum Improvement Proposal (AIP) is the DAO's formal on-chain governance mechanism for approving binding protocol actions, implementing Judge Margaret Garnett's recent court order. Voting on the proposal is scheduled to begin May 15, marking a critical juncture in the legal battle over the frozen assets. The amended proposal would move 30,765 ETH from the wallet where Arbitrum's Security Council immobilized the funds to an Aave LLC-controlled address, as required by the court's order.
A U.S. District Judge Margaret M. Garnett has authorized an onchain Arbitrum DAO vote to transfer 30,766 ETH (approximately $71 million) tied to the rsETH exploit recovery effort to an Aave-controlled wallet, marking a rare legal intervention into active DAO governance. The ruling modifies an earlier restraining notice served on the Arbitrum DAO by plaintiffs in Kim v. Democratic People's Republic of Korea, a U.S. case involving judgment creditors pursuing North Korean-linked assets. On May 5, Aave LLC filed an emergency motion in the Southern District of New York to vacate the restraining notice that had frozen approximately $71 million in ETH tied to the rsETH exploit. The decision specifically permits an on-chain governance vote to relocate the immobilized funds without exposing participants to liability for violating the notice. Once transferred, Aave LLC has committed to honoring the same restrictions on the assets as if the notice had been directed at them directly.
The Arbitrum Security Council originally immobilized the funds following the 18 April rsETH exploit linked to KelpDAO's LayerZero OFT bridge infrastructure. As reported by AMBCrypto, the incident drained roughly 116,500 rsETH worth nearly $292 million at the time. The latest proposal would transfer exactly 30,766 ETH from an Arbitrum-controlled immobilization address to an Aave LLC-controlled wallet, subject to court-approved conditions. On 6 May, positions tied to the identified attacker were liquidated on Aave V3, with the recovered rsETH collateral moved to a Recovery Guardian wallet as part of the coordinated recovery plan. Industry analysts linked the incident to the Lazarus Group, a cyber operation reportedly connected to North Korea. The attacker exploited an access-control flaw in Ekubo's EVM v2 swap router on Ethereum, specifically in the IPayer.pay callback that allowed the attacker to control the payer, token, and amount fields. The attacker chained roughly 85 rapid transactions to drain WBTC from wallets that had previously granted token approvals to the affected router contract.
The legal fight over the frozen assets has taken an unusual turn after blockchain forensics firms widely attributed the exploit to North Korea's Lazarus Group. However, this attribution comes from blockchain analytics firms and external forensic research, and has not been established as a legal finding within either the Arbitrum governance process or the ongoing court proceedings. Lawyers representing families holding roughly $877 million in unpaid U.S. terrorism judgments against North Korea argue that if the assets are ultimately deemed linked to North Korea for enforcement purposes, they could potentially be used to satisfy those longstanding court awards. Aave disputes this premise, arguing that the ether belongs to users harmed in the exploit, not to the attackers who briefly controlled it, turning the case into a fight over whether the funds should go to DeFi victims or to terrorism creditors. In a separate lawsuit, many of the same terrorism judgment creditors sued privacy protocol Railgun DAO, alleging it allowed North Korean-linked funds to move through its infrastructure rather than freezing them.
The proposal changes the original recovery structure significantly, with the amended version routing custody through Aave LLC to align with the court order and simplify legal administration. As reported by AMBCrypto, affected rsETH on Arbitrum will eventually be burned, while corresponding LayerZero packets on Ethereum will be retired to prevent additional minting. The broader goal remains restoring full collateral backing for rsETH and normalizing impacted lending markets. The amended AIP does not request any new treasury allocation from Arbitrum DAO, instead focusing solely on transferring already immobilized ETH into court-supervised custody. Multiple protocols, foundations, and stakeholders pledged over $314 million toward compensating affected parties, with Arbitrum's community showing overwhelming support for releasing the funds through a Snapshot poll with near-unanimous approval. The attacker's conversion path through WETH and DAI on-chain provides a clear forensic trail that supports off-ramp interception requests at downstream exchanges.
