TLDR
- Aave filed an emergency motion in New York to lift a restraining notice blocking the transfer of 30,766 ETH (~$73M) to hack victims
- Law firm Gerstein Harrow LLP claims its clients are owed the funds based on North Korea default judgments
- Aave argues a thief cannot gain legal ownership of stolen property
- The broader “DeFi United” recovery effort has raised over $327 million to compensate rsETH holders
- Aave is requesting a $300 million bond if the freeze cannot be immediately lifted
Aave LLC filed an emergency motion in a New York federal court on Monday to vacate a restraining notice that has frozen around $73 million in Ether connected to the April 18 Kelp DAO exploit.
Aave LLC has filed an emergency motion to vacate a restraining notice served on Arbitrum DAO on May 1, 2026 that attempts to seize approximately $71 million in ETH belonging to victims of the April 18 exploit.
A thief does not gain lawful ownership of stolen property simply by… pic.twitter.com/NwgKIdU1L7
— Aave (@aave) May 4, 2026
The restraining notice was served by Gerstein Harrow LLP on Friday on behalf of clients who hold over $877 million in default judgments against North Korea. The law firm argues that because North Korean hackers allegedly possessed the stolen tokens, its clients have a legal claim to them.
Aave founder Stani Kulechov pushed back firmly. “A thief does not own what he steals,” he said in a statement. “These funds belong to the affected users they were stolen from — full stop.”
The exploit on April 18 involved a flaw in a cross-chain bridge tied to Kelp DAO’s rsETH token. A bad actor used unbacked collateral to borrow roughly $230 million in Ether from Aave users.
Shortly after the attack, the Arbitrum protocol intercepted 30,766 ETH and set it aside for recovery. That Ether, now worth close to $73 million, was expected to be the first major pool of funds returned to victims.
The Arbitrum DAO has been voting on whether to release those funds as part of a broader industry recovery effort. The vote closes Thursday.
What DeFi United Has Raised
That recovery effort, called “DeFi United,” has since grown into an industry-wide push. It has raised more than 137,700 ETH, worth nearly $327 million, though the release of the frozen funds is still pending.
Aave argues the restraining notice puts that entire recovery at risk. Its lawyers warned the court that the delay is causing “irreparable harm” to the protocol, its users, and the wider DeFi community.
The filing also warned that frozen collateral could prevent Aave users from meeting obligations on other positions elsewhere in the market.
Legal Arguments and North Korea Attribution
Aave’s legal team said the plaintiffs’ case rests on “conjecture from posts on the internet” linking the exploit to North Korea’s Lazarus Group. No formal attribution has been confirmed.
The filing states the frozen assets “do not belong to North Korea or any affiliated entities” and belong instead to the Aave users who were victimized.
Aave also warned that if courts uphold this type of restraining notice, it could discourage future crypto recovery efforts and encourage bad actors to target more DeFi protocols.
Gerstein Harrow has filed similar cases before, including against funds from the 2023 Heco Bridge hack and the 2025 Bybit exploit.
If the court cannot immediately vacate the notice, Aave is asking that Gerstein Harrow post a $300 million bond to maintain the freeze.
As of Monday, no judge has ruled on the emergency motion and no hearing date has been scheduled.
