Victims of North Korea Attacks File to Classify Aave Exploit as Fraud, Seeking Frozen $71 Million

Attorneys representing victims of three North Korea terrorism cases filed a 30-page response in a New York federal court on Tuesday, reframing the April 18 exploit on the Aave decentralized lending protocol as fraud rather than theft. The move seeks to preserve a court order freezing $71 million in rsETH-linked ether, which developers tied to the Arbitrum blockchain intercepted before it could be cashed out.

-held property belonging to the sponsoring country, claiming the frozen ether as North Korean state property.

The dispute stems from a cross-chain bridge exploit last month that drained about $230 million from Aave, the largest decentralized lending protocol by total value locked. Forensics firms including Chainalysis and TRM Labs attributed the attack to North Korea’s Lazarus Group, which minted unbacked rsETH tokens, used them as collateral on Aave’s lending markets, and borrowed real ether against the worthless deposits.

The filing argues that this constituted a fraudulent lending transaction where North Korea borrowed assets from users of the Aave Protocol and did not pay them back, leaving the protocol with worthless collateral when it attempted liquidation.

U.S. law, a fraud victim passes title, not merely possession, to a fraudster. The filing draws a parallel to Charles Ponzi, who obtained defeasible title to his victims' cash through his scheme.

It questions whether Aave has standing to challenge the freeze, citing the company’s own terms of service that state it does not have possession, custody or control over user assets. 95 million as of Tuesday morning, more than four times the disputed $71 million. This suggests affected users may not need the frozen ether for recovery.

A hearing on the matter is scheduled for May 6 in a Manhattan federal court.