Key Points
- Aave submitted urgent court documents in New York seeking removal of a restraining order preventing distribution of 30,766 ETH (approximately $73M) to exploit victims
- Gerstein Harrow LLP asserts its clients hold rights to the assets through North Korea-related default judgments
- Aave maintains that stolen assets cannot legally transfer ownership to those who unlawfully obtained them
- Industry coalition “DeFi United” has assembled over $327 million in recovery funds for rsETH token holders
- The protocol demands a $300 million bond be posted should the freeze remain in place
Aave LLC presented emergency court filings to a New York federal judge on Monday, seeking to remove a restraining order that has blocked approximately $73 million in Ethereum tied to the April 18 Kelp DAO security breach.
Gerstein Harrow LLP delivered the restraining notice on Friday, representing parties holding more than $877 million in default judgments against North Korea. The firm contends that the involvement of alleged North Korean hackers in possessing the stolen tokens establishes a legal right to the assets for its clients.
Stani Kulechov, founder of Aave, responded forcefully to the claim. “A thief does not own what he steals,” Kulechov declared. “These funds belong to the affected users they were stolen from — full stop.”
The April 18 security incident exploited a vulnerability in a cross-chain bridge associated with Kelp DAO’s rsETH token. An attacker leveraged unbacked collateral to extract approximately $230 million in Ether from Aave platform users.
Following the attack, the Arbitrum protocol secured 30,766 ETH and designated it for victim reimbursement. This Ethereum, currently valued near $73 million, represented the first significant tranche of assets scheduled for return to affected parties.
The Arbitrum DAO has been conducting governance voting on whether to authorize release of these funds as part of a comprehensive industry recovery initiative. The voting period concludes Thursday.
Recovery Fund Totals
The recovery initiative, known as “DeFi United,” has expanded into a sector-wide collaboration. The effort has accumulated more than 137,700 ETH, valued at nearly $327 million, although distribution of the frozen assets remains on hold.
Aave contends the restraining notice jeopardizes the entire recovery process. Legal representatives for the protocol cautioned the court that continued delays inflict “irreparable harm” on the platform, its user base, and the broader decentralized finance ecosystem.
Court documents further emphasized that frozen collateral could prevent Aave platform users from fulfilling obligations on other positions across the market.
Legal Position and Attribution Questions
Legal counsel for Aave characterized the plaintiffs’ position as founded on “conjecture from posts on the internet” attempting to connect the exploit to North Korea’s Lazarus Group. Official attribution has yet to be established.
Court filings assert the frozen assets “do not belong to North Korea or any affiliated entities” and rightfully belong to the Aave users who suffered losses.
Aave further cautioned that judicial support for this category of restraining notice could discourage future cryptocurrency recovery initiatives and incentivize malicious actors to target additional DeFi protocols.
Gerstein Harrow has pursued comparable litigation previously, including actions involving proceeds from the 2023 Heco Bridge breach and the 2025 Bybit security incident.
Should the court decline to immediately remove the notice, Aave requests that Gerstein Harrow provide a $300 million bond to justify maintaining the freeze.
As of Monday, no judicial decision has been issued regarding the emergency motion and no court hearing has been scheduled.
