- Judge Garnett cleared 30,765 ETH ($71M) for transfer to Aave’s wallet on May 9, 2026.
- The April 18 KelpDAO exploit saw attackers borrow $230M in ETH using unbacked rsETH collateral.
- Aave’s ETH LTV ratios are returning to normal as rsETH bridge recapitalization begins.
Recovery Efforts Garner Further Momentum
Judge Margaret Garnett issued an order on May 9 modifying a prior asset freeze, permitting the Arbitrum Security Council to transfer approximately 30,765 ETH, valued at roughly $71 million, to an Aave LLC-controlled wallet address. The ruling also shields participants in the onchain governance vote that authorized the transfer from legal liability under the prior restraining notice, removing the last major hurdle in a recovery process that began in April.
The crisis traces back to April 18, when attackers exploited a vulnerability in KelpDAO’s cross-chain bridge, using unbacked rsETH tokens as collateral on Aave V3 markets to borrow an estimated $230 million in ETH from the protocol.
The Arbitrum Security Council froze the 30,765 ETH that remained locked in the bridge immediately after the exploit as a protective measure. As detailed earlier, the attack set off one of the most sweeping and coordinated recovery efforts in decentralized finance ( DeFi) history.
The Lazarus Group Involvement
A major legal complication arrived when attorney Charles Gerstein, representing families holding approximately $877 million in unpaid terrorism judgments against North Korea, moved to block the ETH transfer. Gerstein argued the frozen funds were eligible for seizure because the April exploit has been widely attributed to the Lazarus Group, a North Korean state-backed hacking collective.
The claim created serious uncertainty around whether the Arbitrum DAO’s onchain governance vote, which passed with over 90% approval, could be legally executed without exposing participants to liability.
Judge Garnett’s ruling resolves that standoff as her order modifies the restraining notice to allow the ETH transfer to Aave LLC’s address, and explicitly protects voters and operators involved in executing the governance decision from personal legal exposure under the existing freeze.
With the legal pathway clear, the next step in the recovery plan involves using the released ETH to back the rsETH bridge, restoring the 1:1 ratio between rsETH and the underlying ETH collateral that was disrupted in the attack. Aave co-founder Stani Kulechov confirmed on May 9 that ETH loan-to-value (LTV) ratios on the Aave protocol are already in the process of returning to normal parameters.
As Bitcoin.com News reported in the aftermath of the incident, five major DeFi protocols petitioned the Arbitrum DAO to release the frozen ETH, while DeFi United, a coalition formed specifically to address the crisis, raised $160 million to help cover Aave’s bad debt position.
