Aave LLC has filed an emergency motion in a New York federal court seeking to vacate a restraining notice that threatens to derail the recovery of approximately $71 million in Ether intended for victims of the April 18 KelpDAO bridge exploit.
The restraining notice, served on the Arbitrum DAO on May 1 by law firm Gerstein Harrow LLP, attempts to freeze 30,766 ETH that Arbitrum's Security Council had already immobilized in the wake of what became the largest DeFi hack of 2026.
In a post on X, Aave LLC stated: "A thief does not gain lawful ownership of stolen property simply by taking it, and the law is clear on this. Those assets were recovered to be returned to users victimized in the April 18, 2026 exploit. Freezing them harms the very people this recovery effort is designed to protect."
The company added that it has asked the court for an expedited hearing and a temporary vacatur, and is continuing to work alongside the Arbitrum community and DeFi United to make affected users whole.
A Decades-Old Judgment Collides with Modern DeFi
The restraining notice stems from three separate U.S. federal court judgments against North Korea dating from 2010, 2015, and 2016, collectively totaling roughly $877 million in compensatory and punitive damages plus interest. The plaintiffs include victims of the 1972 Lod Airport massacre in Israel, the family of Reverend Kim Dong Shik who was abducted and killed by DPRK agents in 2000, and victims of the 2006 Israel-Hezbollah war.
Gerstein Harrow's legal theory rests on attribution. Because security researchers have linked the KelpDAO exploit to North Korea's Lazarus Group, the firm argues that the frozen ETH constitutes DPRK property subject to seizure under U.S. post-judgment enforcement rules.
The problem is that the victims of the April 18 exploit had nothing to do with Pyongyang's decades of state-sponsored terrorism. They were ordinary depositors who lost funds when attackers compromised RPC nodes used by LayerZero's verification system, exploiting a single-verifier configuration to mint 116,500 unbacked rsETH tokens worth approximately $292 million.
The Recovery Effort at Stake
The frozen Arbitrum funds represent a critical component of a broader recovery initiative called DeFi United, spearheaded by Aave Labs in coordination with KelpDAO, LayerZero, EtherFi, Lido, and others. The coalition has pooled more than $300 million in pledges, loans, and recovered assets to restore rsETH's backing and make affected depositors whole.
Within Arbitrum DAO, a vote to transfer the frozen ETH to the DeFi United recovery fund drew more than 99% support. But the court order now blocks any transfer under threat of contempt.
The legal tool being used is CPLR §5222(b), a New York enforcement mechanism that allows creditors to freeze assets simply by serving a restraining notice, without first obtaining a new court order. Once served, the recipient is barred from moving the assets for up to a year or until the underlying judgment is resolved. Ignoring the notice can lead to contempt of court.
An Uncomfortable Choice Between Victims
An Arbitrum DAO member posting under the handle Zeptimus responded to the restraining notice directly in the governance forum: "Your clients' losses are real and the DPRK should answer for them. But the remedy the restraining notice asks for, blocking the return of stolen funds to their actual owners shifts the cost of the DPRK's debt onto a different set of victims who were themselves robbed."
The case highlights a growing tension between U.S. sanctions enforcement and decentralized governance. If the creditors prevail, the frozen ETH would flow to North Korean terrorism judgment holders rather than to users who lost funds in the exploit.
On-chain analyst ZachXBT has been sharply critical of Gerstein Harrow's approach, calling it predatory and noting that the firm relies on publicly available blockchain analysis from earlier investigations. Taylor Monahan, a member of the Arbitrum Security Council posting as Tay on X, described the firm as having "a history of making people's lives hell for their own financial benefit."
This is not the firm's first attempt at this strategy. In February, Gerstein Harrow filed a claim against funds frozen by Tether that were stolen in the 2023 Heco Bridge hack, also attributed to North Korean actors.
Aave's emergency motion now puts the question before a federal judge: does a foreign sovereign's liability for terrorism decades ago create a superior claim to cryptocurrency stolen from private citizens last month? No final ruling has been issued. Court filings remain active, and Aave depositors with positions they cannot close are waiting.
