Key Highlights
- Aave submitted urgent legal filings in New York federal court seeking removal of a freeze on 30,766 ETH (approximately $73M) earmarked for victims
- Legal representatives from Gerstein Harrow LLP assert their clients have rights to the assets based on court judgments against North Korea
- Aave maintains that stolen assets cannot legally belong to thieves
- The collective “DeFi United” initiative has accumulated over $327 million for compensating rsETH token holders
- Aave demands a $300 million security bond if the restraining order remains in effect
On Monday, Aave LLC submitted emergency court documents to a New York federal judge requesting the immediate removal of a restraining order that has locked approximately $73 million worth of Ethereum linked to the Kelp DAO security breach that occurred on April 18.
The freeze was initiated by Gerstein Harrow LLP last Friday, acting for clients holding more than $877 million in court-ordered judgments against the North Korean government. The firm contends that since North Korean threat actors allegedly controlled the compromised tokens, their clients possess legitimate legal entitlement to the assets.
Stani Kulechov, founder of Aave, responded emphatically to these claims. “A thief does not own what he steals,” Kulechov declared. “These funds belong to the affected users they were stolen from ā full stop.”
The April 18 security incident exploited a vulnerability within a cross-chain bridge associated with Kelp DAO’s rsETH token system. An attacker leveraged uncollateralized positions to extract approximately $230 million in Ethereum from Aave protocol users.
Following the attack, the Arbitrum network successfully intercepted 30,766 ETH and secured it for victim reimbursement. This Ethereum cache, currently valued near $73 million, was intended to serve as the initial substantial distribution to affected parties.
The Arbitrum DAO community has been conducting governance votes to determine whether these funds should be released as part of a comprehensive cross-industry recovery plan. The voting period concludes this Thursday.
DeFi United Recovery Campaign Progress
This restitution initiative, branded “DeFi United,” has evolved into a sector-wide collaborative effort. The campaign has successfully gathered more than 137,700 ETH, representing nearly $327 million in value, although distribution of the frozen portion remains suspended.
Aave contends the restraining order jeopardizes the entire recovery operation. Legal counsel for the protocol cautioned the court that continued delays are inflicting “irreparable harm” on the platform, its user base, and the broader decentralized finance ecosystem.
The court submission further cautioned that immobilized collateral could prevent Aave participants from fulfilling financial commitments on additional positions throughout the cryptocurrency markets.
Legal Strategy and Attribution Questions
Aave’s attorneys argued that the plaintiffs’ position relies on “conjecture from posts on the internet” suggesting connections between the exploit and North Korea’s Lazarus Group. Official attribution has not been established.
The legal filing asserts the frozen funds “do not belong to North Korea or any affiliated entities” and rightfully belong to the Aave community members who suffered losses.
Aave additionally cautioned that judicial approval of such restraining notices could discourage future cryptocurrency recovery initiatives and incentivize malicious actors to target additional DeFi platforms.
Gerstein Harrow has pursued comparable legal actions previously, including cases involving proceeds from the 2023 Heco Bridge compromise and the 2025 Bybit incident.
Should the court decline to immediately lift the restraining notice, Aave requests that Gerstein Harrow furnish a $300 million surety bond to justify maintaining the freeze.
As of Monday evening, no judicial decision has been issued on the emergency petition, and no court hearing has been scheduled.


