Key Takeaways
- Aave submitted an urgent court filing in New York seeking to remove a restraining order that blocks the distribution of 30,766 ETH (approximately $73M) to exploit victims
- Gerstein Harrow LLP asserts its clients hold rights to the cryptocurrency based on court judgments against North Korea totaling over $877 million
- The DeFi protocol maintains that stolen assets cannot legally belong to thieves and must be returned to legitimate victims
- An industry-wide recovery initiative dubbed “DeFi United” has accumulated more than $327 million to reimburse rsETH token holders
- The lending platform demands a $300 million bond from the law firm if the court refuses to lift the freeze immediately
Aave LLC submitted an emergency legal filing to a New York federal court this Monday, demanding the removal of a restraining notice that has locked approximately $73 million worth of Ether linked to the Kelp DAO security breach that occurred on April 18.
The restraining order was issued Friday by Gerstein Harrow LLP, acting on behalf of plaintiffs holding more than $877 million in default court judgments against the Democratic People’s Republic of Korea. The legal firm contends that since North Korean state-sponsored hackers allegedly controlled the stolen cryptocurrency, their clients possess legitimate claims to the assets.
Stani Kulechov, founder of Aave, strongly rejected this position. “A thief does not own what he steals,” Kulechov declared publicly. “These funds belong to the affected users they were stolen from — full stop.”
The April 18 security incident exploited a vulnerability within a cross-chain bridge associated with Kelp DAO’s rsETH token system. An attacker leveraged unbacked collateral to extract approximately $230 million in Ether from Aave’s lending pools.
Following the attack, the Arbitrum blockchain protocol successfully recovered and sequestered 30,766 ETH, designating it for victim restitution. This Ethereum cache, currently valued near $73 million, was anticipated to serve as the initial substantial return of stolen funds.
Arbitrum DAO members have been conducting a governance vote on releasing these assets as part of the comprehensive recovery campaign. The voting period concludes this Thursday.
DeFi United Recovery Campaign Progress
The recovery campaign, operating under the name “DeFi United,” has evolved into a sector-wide collaborative effort. The initiative has successfully gathered more than 137,700 ETH, representing nearly $327 million in value, although distribution remains contingent on the frozen funds’ release.
Aave contends the restraining notice jeopardizes the entire recovery operation. The protocol’s legal representatives cautioned the court that delays inflict “irreparable harm” on the platform, its user base, and the broader decentralized finance ecosystem.
The court submission further emphasized that immobilized collateral could prevent Aave platform users from fulfilling their obligations on leveraged positions across other market venues.
Legal Position and Attribution Questions
Aave’s legal counsel argued that the plaintiffs’ case depends on “conjecture from posts on the internet” attempting to connect the exploit to North Korea’s notorious Lazarus Group. No official attribution has been publicly verified.
The legal document asserts the frozen cryptocurrency “do not belong to North Korea or any affiliated entities” and rightfully belongs to Aave users who suffered losses.
The protocol additionally cautioned that judicial endorsement of such restraining notices could deter future cryptocurrency recovery initiatives and incentivize malicious actors to target additional DeFi platforms.
Gerstein Harrow has pursued comparable legal actions previously, including cases involving proceeds from the 2023 Heco Bridge security incident and the 2025 Bybit exploitation.
Should the court decline to vacate the notice immediately, Aave requests that Gerstein Harrow post a $300 million surety bond to maintain the asset freeze.
As of Monday evening, no judicial decision has been rendered on the emergency filing, and no court hearing has been scheduled.
