Aave frozen ETH dispute has taken a sharp legal turn in New York, where a federal judge stopped short of letting the protocol fully unlock $71 million in frozen ETH tied to the April 2026 KelpDAO exploit. Instead of granting Aave’s emergency request, Judge Margaret M. Garnett declined to rule on the motion for now, leaving the assets under legal restriction even as the platform pushes ahead with parts of its technical recovery.
That pause matters far beyond one court filing. The case sits at the center of a bigger clash between DeFi recovery efforts and U.S. sanctions-related claims, with 30,766 ETH now caught between protocol users seeking restitution and outside plaintiffs trying to seize the assets under terrorism judgments against North Korea.
The timeline is now clearer. Supplemental briefs are due May 22, and the court is expected to take the matter up again around June 5. Until then, one of crypto’s more unusual legal fights remains unresolved.
Summary
Judge pauses Aave’s bid to unlock frozen ETH
Judge Margaret M. Garnett declined to rule on Aave’s emergency motion to fully free the frozen assets. In practical terms, that means Aave did not get the fast relief it wanted, even though the ETH has already been moved into an Aave-controlled wallet under a prior partial order.
The court’s earlier step allowed the transfer, but not a clean release. The restraining notice remained attached to the funds.
That distinction is the heart of the Aave frozen ETH dispute. Aave has possession of the assets, but not full freedom to use them as it argued was necessary to reduce pressure on users and stabilize the fallout from the exploit.
What the judge decided in the Aave frozen ETH dispute
The court put the brakes on Aave’s push to fully unlock the $71 million. Judge Garnett declined to grant immediate relief and instead asked for more briefing.
For now, the next procedural dates are central:
- Supplemental briefs are due May 22
- Further review is expected around June 5
Why the motion was not granted
Aave argued that keeping the ETH restricted could worsen losses, trigger user liquidations, and fuel broader instability across DeFi markets. However, the judge found the emergency filing did not sufficiently show how those losses would materialize if the restraining notice stayed in place.
That is an important legal signal. Courts often move fastest when a party shows immediate, concrete harm. Here, the judge appears to have decided that the case’s legal complexity outweighed the urgency Aave described.
How the KelpDAO exploit led to the freeze
The frozen assets stem from the April 2026 KelpDAO exploit, which hit one of DeFi’s most sensitive fault lines: bridge infrastructure.
On April 18, 2026, attackers exploited a single-verifier vulnerability in KelpDAO’s LayerZero bridge. According to the case record provided here, that led to the fraudulent minting of about $292 million in unbacked rsETH.
The damage spread quickly. The exploit created collateral stress inside Aave’s lending markets, triggered rsETH depegging, and caused more than $7 billion in temporary DeFi TVL outflows.
The bridge vulnerability and the Arbitrum Security Council freeze
Bridge failures can turn technical bugs into market-wide shocks, especially when the affected asset is used as collateral across lending systems. That is what made this incident more than a single protocol problem.
Arbitrum’s Security Council responded by freezing 30,766 ETH linked to the attack. That move helped halt further movement of the funds, but it also created a new problem: once assets are frozen and identified, other legal claimants may try to reach them.
Why this matters for DeFi recovery
This is one of the clearest examples yet of how a protocol’s recovery path can split into two separate tracks.
On one track, developers and partner protocols work to restore operations, refill lockboxes, and reopen bridging. On the other, courts decide whether recovered assets can actually be used for victim restitution.
That split matters because it changes what “recovery” means in DeFi. Recovering control of funds may not be enough if those assets immediately become subject to outside legal claims.
The legal fight over who can claim the funds
The most consequential part of the case may not be the exploit itself, but who gets the frozen ETH now.
On May 1, Gerstein Harrow LLP filed a restraining notice on behalf of plaintiffs holding terrorism judgments against North Korea. Their argument is that the frozen ETH should be treated as DPRK property because of alleged Lazarus Group involvement in the hack.
That claim has raised a hard and still unresolved question: if a DAO or protocol helps recover assets tied to a hack, can unrelated judgment creditors step in and claim those funds before users are made whole?
The restraining notice and the court’s partial order
Judge Garnett’s May 9 partial order allowed the ETH to be transferred into an Aave-controlled wallet, but with the restraining notice still attached.
So while the funds moved, the legal dispute moved with them.
That arrangement kept the assets from being fully released into Aave’s recovery process. It also preserved the court’s ability to sort out competing claims before any final distribution.
Why the dispute could shape future crypto recoveries
This is where the Aave frozen ETH dispute could end up shaping more than one protocol’s future. The case may become a test of whether DAO-recovered hack funds can be seized by unrelated judgment creditors pursuing sanctions-related or terrorism-judgment claims.
Why that matters is simple: if recovery wallets become legally reachable by third parties, every future DeFi rescue effort may need to be structured differently from the start. Governance votes, security freezes, and restitution plans could all face a new layer of legal planning.
Aave’s recovery plan continues separately
Even with the court fight unresolved, Aave and KelpDAO are moving ahead with the technical side of the recovery.
Aave said the first rsETH tranche has been transferred into the LayerZero OFT adapter as part of the coordinated restart plan with KelpDAO. It also said rsETH bridging between Ethereum mainnet and L2s is back open.
“The first tranche of rsETH has been transferred into the LayerZero OFT adapter, and rsETH bridging between mainnet and L2s is back open.” — Aave (May 13, 2026)
rsETH bridge restart and withdrawals
The reopening of the bridge is a key operational milestone. It signals that the rsETH bridge restart is no longer just a recovery plan on paper but an active process moving forward despite the courtroom delay.
Aave also said rsETH withdrawals are set to unpause within 24 hours, with deposits and exchange rate updates to follow within 48 hours. Staking rewards accrued during the pause period are set to go to rsETH holders.
Remaining tranches from Aave’s Recovery Guardian and KelpDAO’s safe are expected to complete the lockbox refill over the next two weeks.
What happens next
For users, the message is mixed but clearer than it was days ago. Operational recovery is progressing. Legal recovery is not settled.
That separation is important. The restricted $71 million does not stop all technical restoration work, because other funds are being used to help cover the gap while the court reviews the dispute.
Still, the June timeline now carries outsized weight. By around June 5, the court’s next step could offer one of the first meaningful answers to a question that is getting harder for crypto to avoid: when protocols recover hacked assets, who has the strongest claim to them in the eyes of U.S. law?
However the court answers that, the result may influence how DeFi protocols design emergency controls, bridge recovery systems, and restitution plans long before the next exploit hits.
