- Trending
- Comments
- Latest
Aave and Arbitrum are locked in a New York federal court battle to stop terrorism judgment creditors from seizing $71 million in ETH recovered from a North Korea-linked hack, a case that could determine whether DeFi’s emergency recovery tools expose protocols to seizure by outside creditors.
The case, unfolding in the Southern District of New York, has already produced a partial win for Aave but remains unresolved, with a critical hearing scheduled for June 5, 2026.
At stake is far more than $71 million. This case will determine whether DeFi’s emergency recovery mechanisms create legal jurisdiction for outside creditors, effectively turning security councils into enforcement targets for anyone with a court judgment.
| Key Element | Detail |
|---|---|
| Disputed Amount | 30,766 ETH (~$71 million) |
| Total Exploit Loss | ~$293 million (rsETH on KelpDAO bridge) |
| Plaintiff Claims | $877 million in unpaid terrorism judgments against North Korea |
| Aave’s Counter | Filed emergency motion on May 4, 2026 |
| Current Status | Hearing delayed; briefs due May 22, next hearing June 5 |
| Judge | Margaret M. Garnett, SDNY |
On April 18, 2026, KelpDAO suffered one of the year’s largest DeFi exploits. Attackers exploited a vulnerability in KelpDAO’s LayerZero bridge, specifically a single verifier configuration that allowed them to compromise RPC nodes and feed false data.
The result: approximately 116,500 rsETH was fraudulently unlocked from Ethereum mainnet escrow, causing losses of roughly $293 million.
The attack was widely attributed to North Korea’s Lazarus Group, state sponsored hackers who have become the most prolific crypto thieves in the world. Aave alone absorbed between $124 million and $230 million in bad debt from positions that had used the resulting unbacked rsETH as collateral.
Within 48 hours, the Arbitrum Security Council, a small group of multisig signers with emergency powers, froze 30,766 ETH that had landed on the layer 2 network. This intervention prevented the attacker from moving the funds further.
The freeze was immediately praised as a rare success story in crypto recovery. But it also created something else: a static, identifiable wallet that a U.S. court could target.
On May 1, 2026, attorney Charles Gerstein of Gerstein Harrow LLP filed a restraining notice on Arbitrum DAO. His clients, families holding more than $877 million in unpaid terrorism judgments against North Korea, argued a simple but aggressive theory:
Aave responded within days. On May 4, the protocol filed a 29 page emergency motion asking Judge Margaret Garnett to vacate the restraining notice. The filing made three demands:
Aave’s core legal argument was simple, grounded in basic property law: A thief does not gain lawful ownership of stolen property simply by taking it. Stani Kulechov, founder of Aave Labs, put it directly: “These funds belong to the affected users they were stolen from, full stop”.
The case has produced two significant court actions, one favorable to Aave, one that keeps the pressure on.
On May 8, Judge Garnett issued a two page order that allowed Aave to transfer the frozen ETH from Arbitrum to a wallet controlled by Aave LLC. This was a meaningful win: it permitted the recovery process to continue through an onchain Arbitrum DAO governance vote, with the order explicitly shielding anyone who initiated, voted on, or participated in the transfer from personal liability.
But crucially, the legal freeze did not disappear. It traveled with the assets. The restraining order would attach to Aave LLC upon transfer. As one analysis put it: “Aave can technically shift the ETH from one wallet to another, but the court’s hold attaches to the assets no matter where they sit”.
The judge also authorized the ongoing recovery work. On May 6, liquidators had already closed the thief’s eight identified positions on Aave V3, transferring the recovered rsETH collateral to the Recovery Guardian under an approved governance process.
Then on May 13, Judge Garnett delayed Aave’s request to unfreeze the funds entirely. She ordered both parties to submit supplemental briefs by May 22, with the next hearing scheduled for June 5.
The judge’s order identified six specific legal issues requiring clarification:
| Issue | Question |
|---|---|
| 1 | Do the hack transactions fall under New York’s shelter principle? |
| 2 | What is the legal distinction between fraud and theft in this context? |
| 3 | What rights does a hacker have over stolen assets? |
| 4 | Which legal standard governs creditor priority on frozen assets? |
| 5 | Is a constructive trust an appropriate remedy? |
| 6 | Can Aave or Arbitrum identify individual victims to return assets proportionally? |
Judge Garnett noted that Aave had failed to adequately demonstrate how user funds would suffer “compounded losses” if the injunction remained in place. She acknowledged the complexity of the case and the risks faced by victims, but signaled she was not ready to rule without deeper briefing.
The most important aspect of this case, and the one with the broadest implications, is the trap that emergency recovery created.
As one legal analysis noted: “The very mechanism DeFi uses to protect exploit victims gave external creditors the procedural foothold to claim those same funds”. When Arbitrum’s Security Council froze the 30,766 ETH, it converted the assets from in flight stolen property into a held position, static, identifiable, and under the control of a known governance body. That gave Gerstein Harrow something to serve a restraining notice on.
This creates a devastating calculation for future DeFi rescues:
Freeze the funds → Create legal jurisdiction → Outside creditors can claim the assets
Let the funds disperse → Lose them entirely → Victims get nothing
Either choice carries serious consequences. Protocols that build emergency powers may now find those powers become legal liabilities. The same mechanism designed to protect users becomes a vector for seizure.
The $300 million bond demand in Aave’s original motion was not random. It was leverage.
If Judge Garnett requires plaintiffs to post a cash bond of that size as a condition of maintaining the freeze, the case effectively ends. Gerstein Harrow’s clients are seeking to collect from $877 million in unpaid judgments, they almost certainly do not have $300 million in liquid capital to post as bond. A meaningful bond requirement would force a settlement or withdrawal.
Gerstein Harrow has not yet filed a public response to Aave’s motion. But the firm has signaled it is not backing down. The same plaintiffs have also sued Railgun DAO and named Digital Currency Group in a separate case, arguing a $10 million governance token purchase made DCG liable for DPRK fund flows through the protocol.
Three open questions will define the outcome and shape DeFi’s legal future for years.
Aave’s filing raises procedural concerns about whether Arbitrum DAO qualifies as a legal entity capable of being served as a garnishee. If Judge Garnett rules it cannot be served in the manner attempted, the restraining notice fails on procedural grounds before reaching the property dispute. If she rules it can be served, every DAO with U.S. jurisdictional touchpoints becomes a serviceable defendant.
Aave’s lawyers called the plaintiffs’ claim that “DAOs like Arbitrum DAO have been held to be general partnerships” flatly false, noting that neither Samuels v. Lido DAO nor Sarcuni v. bZx DAO held any DAO to be a partnership.
The plaintiffs’ theory requires the court to treat ETH that briefly passed through an attacker’s wallet as North Korean property. Aave’s filing argues this collapses the standard rule that title doesn’t pass via theft. If the court accepts the plaintiffs’ theory, on chain attribution becomes a sufficient basis to convert any recovered exploit funds into seizable state assets.
This is the practical pressure point. If Judge Garnett requires the bond, the freeze likely ends. If not, the case proceeds to a merits determination that could reshape crypto asset recovery.
Despite the legal uncertainty, the technical recovery continues. On May 10, Arbitrum DAO voted to release the frozen ETH, contingent on resolving the legal disputes. The DeFi United coalition, including Aave, KelpDAO, Certora, Consensys (pledged 30,000 ETH), Mantle (pledged 30,000 ETH), and Kulechov personally (pledged 5,000 ETH), has assembled over $311 million in committed capital to make rsETH holders whole.
The next recovery phases include:
Kelp and Aave announced on May 13 that the rsETH held by the hacker had been destroyed on Arbitrum, with approximately $278 million in lost tokens to be restored over the following two weeks via the Aave Recovery Guardian multisig wallet.
This case is not an outlier. It follows the same pattern as the U.S. Treasury’s $344 million stablecoin freeze tied to Iran and the Dubai court’s $456 million TrueUSD asset freeze. In each case, the state didn’t need to rewrite blockchain rules, it simply applied existing legal pressure to known entities.
For DeFi protocols, the lesson is clear: if a court can find a person or organization with enough influence to move funds, it can freeze assets. That reality will reshape how projects design governance, multisig signer distribution, and emergency powers.
The Aave/Arbitrum case will be cited repeatedly in regulatory hearings over the coming year. As one analyst put it: “The smart money is not on DeFi evading the state, but on protocols building the infrastructure to comply selectively. This case is a blueprint for that new compliance layer”.
The June 5 hearing will determine whether that blueprint prioritizes victims or creditors, and whether DeFi’s safety net remains a shield or becomes a legal spear pointed at the protocols themselves.
Copyright © 2025 - The Bit Gazette.
