A legal showdown in New York is threatening to reroute — or permanently lock — 30,766 ETH tied to the April Kelp DAO hack, as Aave pushes to unblock funds that DeFi users and recovery efforts say should be returned to victims.
What’s happening
- Aave filed an emergency motion Monday in the U.S. District Court for the Southern District of New York asking a judge to vacate a restraining notice that has prevented the Arbitrum DAO from moving roughly 30,766 ETH (about $71 million).
- The restraining notice was served May 1 by law firm Gerstein Harrow LLP, which claims its clients hold more than $877 million in default judgments against North Korea and alleges the Kelp hackers are North Korean operatives — a basis the firm says gives its clients a legal claim to the frozen ETH.
- Aave’s filing pushes back, calling the North Korea allegation “conjecture from posts on the internet” and arguing broadly that a thief does not gain lawful title to stolen property by taking it.
Two possible outcomes sought by Aave
- Immediate vacatur of the restraining notice so Arbitrum DAO can proceed with plans to release the ETH.
- If the court refuses immediate action, Aave asks the court to require Gerstein Harrow to post a $300 million bond to keep the freeze in place — effectively forcing the law firm to put up collateral before the assets remain blocked.
Why the freeze matters now
The ETH was frozen after the April 18 Kelp DAO exploit, an attack that moved roughly $292 million in total. Arbitrum DAO has been considering a governance proposal to hand the frozen ETH to DeFi United, a coordinating effort intended to make rsETH holders whole and restore token backing. That vote is scheduled to close May 7.
Gerstein Harrow’s restraining notice landed just days before the vote deadline, leaving Arbitrum DAO unable to move the assets without risking contempt of court — and potentially preventing the community-approved recovery plan from executing.
Aave warns of broader damage
In its emergency filing, Aave argues the continued restraint risks real, time-sensitive harm. Some of the frozen ETH had been used as collateral in other lending protocols; borrowers may now be unable to meet obligations, and prolonged uncertainty could ripple through the DeFi ecosystem. Aave’s public statement summed the legal point plainly: “A thief does not gain lawful ownership of stolen property simply by…,” emphasizing that ownership claims based on alleged ties to sanctioned actors aren’t settled facts.
Gerstein Harrow’s track record
This is not the first time Gerstein Harrow has used similar tactics. The firm has pursued restraining actions tied to assets from the 2023 Heco Bridge hack and the 2025 Bybit exploit, each time arguing that frozen funds connected to North Korean hackers should be diverted to its clients — who hold large default judgments against the DPRK — rather than to the victims or the platforms trying to restore losses.
What’s next
No hearing has been scheduled and a judge has not yet ruled. The outcome will determine whether the 30,766 ETH stays locked as part of a contested legal claim tied to international judgment enforcement — or whether it can flow to DeFi United and affected users under the Arbitrum DAO recovery plan.
The case highlights an emerging clash between on-chain governance, cross-border recovery claims, and courts seeking to enforce complex judgments against alleged state-linked hackers — with millions of dollars and wider DeFi stability hanging in the balance.
Read more AI-generated news on: undefined/news
