Cryptocurrencies,  Security

Aave: ‘A Thief Does Not Own What He Steals’

Lending protocol fights effort to seize $73M stolen in Kelp DAO attack

By  / May 4, 2026 /

“A thief does not own what he steals.”

So said Aave founder Stani Kulechov in a statement following an emergency court filing seeking to unfreeze $73 million retrieved by Arbitrum DAO in the wake of a $293 million exploit.

The Kelp DAO hack on April 18 left decentralized finance lending platform Aave stuck with $230 million in bad debt after hackers, believed to be from North Korea, used stolen and unbacked rsETH tokens to take out loans on Aave. That led to a bank-run style wave of withdrawals on Aave that effectively froze the protocol.

The crypto community has rallied around Aave and Kelp DAO, raising $300 million in donations and loans to cover the losses. A sizable chunk of that came from Arbitrum DAO, which managed to freeze $73 million in stolen funds. Its attempt to return them, however, was halted by a federal court on May 1 after a group of plaintiffs who have won hundreds of millions of dollars in judgments against the Democratic People’s Republic of Korea over terrorism incidents got an injunction.

Those plaintiffs are seeking to seize the stolen $73 million on the theory that it belongs to North Korea and is therefore subject to garnishment.

“Aave LLC filed an emergency motion today to vacate the restraining notice served on Arbitrum DAO, rejecting the baseless claim that stolen property title belongs to the thief,” Kulechov said on X. “We will keep fighting for the DeFi community.”

The $300 million was collected by DeFi United, a group that sprung up in the wake of the exploit. Kelp DAO was the second major hack in April, which began with the $285 million hack of Drift Protocol, also attributed to North Korea. In all, more than $600 million was lost to hacks and exploits in April.

“What plaintiffs fail to mention — presumably because it would give the Court significant pause with respect to any of plaintiff’s requested relief — is that the theft from the Aave Protocol has caused a myriad of direct and indirect harms (including resulting liquidity restraints) that have rippled through the DeFi community, which need to be mitigated and addressed immediately, with as much speed as possible,” Aave’s court filing read.

It also noted that there is no proof North Korean hackers were responsible, merely opinion (albeit a very well-informed opinion).

 You May Also Like

Leo Jakobson, Modern Consensus editor-in-chief, is a New York-based journalist who has traveled the world writing about incentive travel. He has also covered consumer and employee engagement, small business, the East Coast side of the Internet boom and bust, and New York City crime, nightlife, and politics.