Key Takeaways
- Aave submitted an urgent legal filing in New York seeking to remove a freeze on 30,766 ETH (approximately $73M) designated for hack victims
- Gerstein Harrow LLP asserts their clients have rights to the assets based on court judgments against North Korea
- Aave contends that stolen assets cannot legally transfer ownership to thieves
- The collective “DeFi United” initiative has accumulated over $327 million for compensating rsETH token holders
- The protocol demands a $300 million surety bond if the court maintains the freeze
Aave LLC submitted urgent legal paperwork to a federal court in New York this Monday, seeking removal of a restraining order that has locked approximately $73 million worth of Ether linked to the Kelp DAO security breach that occurred on April 18.
The freeze was initiated by Gerstein Harrow LLP this past Friday, representing clients holding more than $877 million in court judgments against the North Korean government. The legal firm contends that since North Korean-linked hackers allegedly controlled the stolen digital assets, their clients possess legitimate claims to the recovered funds.
Stani Kulechov, the founder of Aave, rejected this position unequivocally. “A thief does not own what he steals,” he declared publicly. “These funds belong to the affected users they were stolen from — full stop.”
The April 18 security incident exploited a vulnerability in a cross-chain bridge associated with Kelp DAO’s rsETH token system. An attacker leveraged unbacked collateral to extract approximately $230 million in Ether from Aave platform users.
Immediately following the breach, the Arbitrum protocol successfully intercepted 30,766 ETH and sequestered it for victim restitution. This Ethereum cache, currently valued near $73 million, was anticipated to represent the initial significant tranche of returned assets.
The Arbitrum DAO has been conducting a governance vote on releasing these funds as part of a comprehensive industry recovery campaign. The voting period concludes Thursday.
Total Funds Mobilized by DeFi United
This recovery campaign, branded “DeFi United,” has evolved into a sector-wide collaborative effort. The initiative has accumulated more than 137,700 ETH, representing nearly $327 million in value, although distribution of the frozen assets remains on hold.
Aave maintains the restraining order jeopardizes the entire recovery operation. Legal representatives cautioned the court that continued delays inflict “irreparable harm” on the protocol infrastructure, its user base, and the broader decentralized finance ecosystem.
The legal submission also highlighted that frozen collateral could prevent Aave platform users from fulfilling financial obligations on additional positions throughout the marketplace.
Legal Framework and Attribution to North Korea
Aave’s attorneys argued the plaintiffs’ position depends on “conjecture from posts on the internet” connecting the exploit to North Korea’s Lazarus Group. No official attribution has been established.
The court filing asserts the frozen assets “do not belong to North Korea or any affiliated entities” and rightfully belong to the Aave users who suffered losses.
Aave additionally cautioned that judicial validation of such restraining orders could discourage future cryptocurrency recovery initiatives and incentivize malicious actors to target additional DeFi platforms.
Gerstein Harrow has pursued comparable litigation previously, including cases involving proceeds from the 2023 Heco Bridge breach and the 2025 Bybit security incident.
Should the court decline to immediately remove the restraining notice, Aave requests that Gerstein Harrow provide a $300 million bond to justify continuing the freeze.
As of Monday evening, no judicial decision has been rendered on the emergency filing and no court hearing has been scheduled.





