TLDR
- Aave submitted an urgent court filing in New York seeking removal of a restraining order preventing distribution of 30,766 ETH (approximately $73M) to victims of the hack
- Gerstein Harrow LLP asserts its clients have rights to the assets through North Korea-related default judgments
- Aave contends that stolen assets cannot be legally owned by the perpetrator
- A collaborative “DeFi United” initiative has accumulated over $327 million for rsETH holder compensation
- Aave seeks a $300 million bond requirement if the restraining order remains in effect
Aave LLC submitted an emergency legal filing to a federal court in New York this Monday, requesting the removal of a restraining order that has immobilized approximately $73 million worth of Ether linked to the Kelp DAO security breach from April 18.
The restraining order was issued by law firm Gerstein Harrow LLP last Friday, representing clients who possess more than $877 million in default judgments against the North Korean government. The firm contends that since North Korean hackers allegedly controlled the stolen cryptocurrency, their clients maintain a legitimate claim to the assets.
Stani Kulechov, founder of Aave, responded forcefully to these assertions. “A thief does not own what he steals,” he declared. “These funds belong to the affected users they were stolen from — full stop.”
The April 18 security breach exploited a vulnerability in a cross-chain bridge associated with Kelp DAO’s rsETH token. An attacker leveraged unbacked collateral to extract approximately $230 million in Ether from Aave platform users.
Immediately following the incident, the Arbitrum protocol secured 30,766 ETH and designated it for victim restitution. These tokens, currently valued near $73 million, were anticipated to constitute the initial significant distribution of recovered assets to those affected.
The Arbitrum DAO is currently conducting a vote on whether to authorize the release of these funds as part of a comprehensive industry recovery initiative. The voting period concludes Thursday.
What DeFi United Has Raised
This recovery initiative, dubbed “DeFi United,” has evolved into a sector-wide collaborative effort. The campaign has successfully gathered more than 137,700 ETH, valued at approximately $327 million, although distribution of the frozen assets remains on hold.
Aave maintains that the restraining order jeopardizes the entire recovery operation. The protocol’s legal representatives cautioned the court that the postponement is inflicting “irreparable harm” on the platform, its user base, and the broader decentralized finance ecosystem.
The court submission also highlighted that immobilized collateral could prevent Aave participants from fulfilling obligations related to other positions across the marketplace.
Legal Arguments and North Korea Attribution
Aave’s legal counsel argued that the plaintiffs’ position relies on “conjecture from posts on the internet” suggesting connections between the exploit and North Korea’s Lazarus Group. Official attribution has not been established.
The legal filing asserts that the frozen tokens “do not belong to North Korea or any affiliated entities” and rightfully belong to the Aave users who suffered losses.
Aave further cautioned that judicial approval of such restraining notices could discourage future cryptocurrency recovery initiatives and embolden malicious actors to target additional DeFi platforms.
Gerstein Harrow has pursued comparable legal actions previously, including cases involving assets from the 2023 Heco Bridge breach and the 2025 Bybit security incident.
Should the court decline to vacate the restraining notice immediately, Aave requests that Gerstein Harrow be required to post a $300 million bond to sustain the freeze.
As of Monday evening, no judicial decision has been issued regarding the emergency motion, and no court hearing has been scheduled.
