Aave LLC moved swiftly in federal court Monday to unwind a restraining notice that has locked up roughly $71 million in Ethereum recovered from the April 18 Kelp DAO exploit.
The filing accuses Gerstein Harrow LLP of trying to reroute victim restitution to satisfy decades-old default judgments against North Korea. The dispute pits straightforward property law against a novel attempt to treat stolen crypto as North Korean state assets.
The case, filed in the Southern District of New York before Judge Margaret M. Garnett, has drawn sharp attention across the decentralized finance (DeFi) community.
Arbitrum DAO’s Security Council froze the 30,766 ETH shortly after the hack and planned to channel the funds into a restitution effort run with the DeFi United initiative.
Stopping this process was Gerstein Harrow’s May 1 restraining notice. The firm represents plaintiffs holding more than $877 million in unpaid judgments tied to North Korean abduction and terrorism cases dating back to 2010-2016.
Aave’s emergency motion to vacate
In the 29-page memorandum submitted by Morrison Cohen LLP, Aave LLC asked the court to vacate the notice immediately or, at minimum, grant an expedited hearing with temporary relief.
The filing, which matches the document provided, rests on a simple premise: stolen property does not change ownership simply because a thief took it.
“A thief does not gain lawful ownership of stolen property simply by taking it, and the law is clear on this,” the motion states. “Those assets were recovered to be returned to users victimized in the April 18, 2026 exploit. Freezing them harms the very people this recovery effort is designed to protect.”
Aave further argued that the plaintiffs’ theory—that any Lazarus-linked funds automatically become DPRK assets eligible for civil execution—overreaches both sanctions law and traditional forfeiture rules.
OFAC sanctions block transactions with designated entities, the filing notes, but do not automatically convert stolen goods into state property subject to private judgments. Civil forfeiture of blocked assets typically requires government action, not private counsel filing writs of execution.
The motion requests that, if the freeze remains in place pending a hearing, plaintiffs post a bond of at least $300 million to cover potential damages to victims.
The hack and the frozen assets
On April 18, attackers drained approximately $292 million in rsETH from Kelp DAO’s LayerZero bridge. On-chain analysis quickly attributed the theft to wallets linked to the Lazarus Group, the North Korea-backed hacking collective already sanctioned by the U.S. Treasury’s Office of Foreign Assets Control.
Arbitrum’s Security Council moved within days to immobilize the traceable portion—30,766 ETH—then sitting on the layer-2 network. Aave, which had absorbed significant bad debt from the exploit through its rsETH markets, joined Kelp DAO, LayerZero and others in coordinating a return of the recovered ETH.
The plan called for transferring the assets to a multi-party recovery contract controlled by Aave, Kelp and Certora. From there, the funds would help restore rsETH holders and reduce losses across affected protocols.
That process ground to a halt when Gerstein Harrow served the restraining notice on Arbitrum DAO, claiming the ETH qualified as North Korean property subject to execution on its clients’ judgments.
Swift community reaction
Hayden Adams, founder of Uniswap, highlighted that Gerstein Harrow LLP is the same firm behind a 2021 lawsuit against Compound Labs and Aave founder Stani Kulechov. In that case, an Elizabeth Warren staffer lost roughly $276 in a PoolTogether lottery and sued the protocols for over $200 million—only to lose.
Adams called the current restraining notice another example of the firm’s pattern, suggesting its real goal is to damage DeFi by delaying the return of stolen funds to victims.
Weighed in on Aave’s motion, an X user noted, “stealing something doesn’t make it yours.” “Lazarus moving stolen ETH through their wallets doesn’t suddenly turn it into North Korean property that creditors can claim. The legal theory here is clever but backwards.”
Another user’s comment on Aave’s emergency motion X post called the dispute “the most dangerous precedent in DeFi history,” warning that if a U.S. court can overrule 100% DAO consensus on property rights, “decentralization” is just an illusion.
“A thief doesn’t gain title to stolen goods. Aave’s legal defense isn’t just about $71M, it’s about the sovereignty of on-chain property,” he notes.
Many users highlighted that every day of delay hurts rsETH holders who have nothing to do with North Korea and urged the court to move quickly.
What the dispute means for DeFi
The legal maneuver has sparked alarm beyond the immediate parties. Community observers worry the precedent could discourage future recoveries. Protocols routinely freeze and trace stolen assets in hopes of restitution. If private judgment creditors can insert themselves ahead of victims, the incentive for on-chain sleuthing and cooperative freezes evaporates.
Hackers, in turn, might route proceeds through sanctioned networks knowing U.S. courts could become an unintended payout mechanism for regime debts.
Aave’s motion underscores a broader tension: DeFi operates in code and smart contracts, yet increasingly collides with traditional courtrooms when large sums are at stake.
The Arbitrum DAO, a decentralized governance body for Arbitrum blockchain, now finds itself named in federal litigation despite lacking a traditional corporate structure.
How the court treats service of process and jurisdiction over a DAO will matter as much as the property-law arguments. No hearing date has been set. Gerstein Harrow has not yet filed a response in the public record.
For now, the 30,766 ETH remains frozen on Arbitrum while victims of the Kelp exploit wait. Aave said it continues working with the Arbitrum community and DeFi United to prepare for an eventual return of funds once the legal cloud lifts.
The outcome could clarify whether recovered crypto belongs first to those who lost it—or to creditors holding paper judgments against a nation-state.
Also read: Ripple Teams Up with Crypto ISAC to Stop North Korean Hackers
