North Korea Terror Victims Say Aave Was Defrauded, Not Robbed, in Fight Over $71 Million

Image Credit: Shutterstock

Lawyers representing victims of North Korean terrorism filed a 30-page opposition brief on Tuesday arguing that the losses Aave suffered in the April 18 Kelp DAO exploit resulted from a fraudulent lending transaction rather than a theft.

U.S. law treats the two differently: fraudsters can obtain legal title to property acquired through deception, while thieves cannot. A hearing is scheduled for Wednesday in a Manhattan federal court.

Plaintiffs Say North Korea Borrowed Real Ether Against Worthless Collateral

The opposition brief, filed in the Southern District of New York, directly counters Aave’s argument that the frozen ether belongs to exploit victims and not to the attacker.

The plaintiffs’ attorneys describe the losses not as the result of a smash-and-grab but of a fraudulent borrowing. The attacker exploited Kelp DAO’s cross-chain bridge to mint unbacked rsETH tokens, posted them as collateral on Aave’s lending markets, and borrowed real ether against the worthless deposits. When Aave’s protocol attempted to liquidate the collateral, it discovered the collateral had no value.

“What actually happened is that North Korea borrowed assets from users of the ‘Aave Protocol’ and did not pay it back, and when the ‘Aave Protocol’ sought to liquidate North Korea’s collateral, the ‘Aave Protocol’ unhappily discovered that the collateral was worthless,” the filing reads.

The legal argument hinges on a longstanding principle in U.S. property law.

“The law is crystal clear that a fraud victim passes title, not merely possession, to a fraudster,” the filing states.

Citing Charles Ponzi’s case as precedent for the concept that fraud produces “defeasible title” rather than mere possession.

Plaintiffs Use the Terrorism Risk Insurance Act to Claim the Frozen $71 Million

The brief escalates the dispute beyond New York property law by invoking the Terrorism Risk Insurance Act (TRIA), a post-9/11 federal statute that allows holders of terrorism judgments against state sponsors to collect from any U.S.-held property belonging to the designated country.

If the court accepts that the attacker obtained title to the borrowed ether through fraud and that the attacker is an agent of North Korea, the frozen funds could qualify as North Korean state property subject to seizure under TRIA. That theory would bypass Aave’s arguments about New York property law and shift the case onto federal terrorism-enforcement grounds.

The exploit has been attributed to North Korea’s Lazarus Group by forensics firms including Chainalysis and TRM Labs, though the attribution has not been confirmed through a formal law enforcement finding.

Aave’s Own Terms May Undermine Its Standing to Fight the Freeze

The opposition brief also raised a standing question. It cited Aave’s own terms of service, which state that the protocol does not have “possession, custody or control” over user assets. That language is a core feature of how decentralized finance protocols present themselves legally.

The plaintiffs argue that if Aave does not control the assets, it may lack the legal standing to challenge a restraining order that freezes them. The argument turns one of DeFi’s foundational legal positions into a potential liability in the courtroom.

A $330 Million Recovery Fund Undercuts Aave’s Argument

The filing also noted that the affected Aave users may not need the frozen ether to be made whole. DeFi United, the industry-led recovery coalition that Aave itself participates in, had raised about $330.44 million as of Tuesday morning, more than four times the $71 million at issue in the freeze.

The plaintiffs’ attorneys framed that figure as evidence that releasing the frozen funds to terrorism victims would not leave Aave’s users without recourse. Aave filed an emergency motion last week asking the court to either vacate the restraining notice or require the plaintiffs to post a bond of at least $300 million. Aave founder Stani Kulechov argued at the time that “a thief does not own what he steals.”

The fraud-versus-theft distinction now at the center of the case directly challenges that framing. Wednesday’s hearing will determine whether the freeze holds while the underlying claims are litigated.