Aave seeks court relief to unfreeze ETH under restraining notice

Aave, the decentralized finance protocol, has filed an emergency motion in a New York court to vacate a restraining notice that would block Arbitrum DAO from transferring 30,766 Ether to the victims of the Kelp DAO exploit. Gerstein Harrow LLP served the notice on Arbitrum DAO last Friday, claiming its clients hold default judgments against North Korea worth about $877 million and that the Kelp hacker group had possession of the stolen tokens, giving a legal claim over the Ether. Aave contends that theft does not confer ownership and argues that North Korea is only suspected to be involved, calling the notice “logically and legally incoherent.”

Meanwhile, Arbitrum DAO has been voting on whether to release the Ether to support DeFi United, an industry-wide coordination effort aiming to restore rsETH holders and backing after the roughly $292 million Kelp DAO hack on April 18. The voting window closes on May 7, with the outcome shaping how the DeFi ecosystem responds to the incident.

Key takeaways

• Aave filed an emergency motion to vacate a restraining notice intended to stop Arbitrum DAO from moving 30,766 ETH to Kelp exploit victims, arguing the claim rests on disputed ownership and questionable attribution to North Korea.
• The restraining order stems from Gerstein Harrow’s assertion that its clients hold default judgments against North Korea amounting to roughly $877 million tied to the incident.
• Arbitrum DAO’s vote to unfreeze the Ether is part of a broader effort, DeFi United, to make rsETH whole and restore the token’s backing after the April hack.
• Aave warns that delays could inflict “irreparable harm” on users and the broader DeFi ecosystem, potentially destabilizing collateral arrangements tied to immobilized assets.
• Gerstein Harrow has pursued similar recoveries in the past, including funds linked to the 2023 Heco Bridge hack and the 2025 Bybit exploit, setting a legal backdrop that readers should watch for in upcoming court actions.

Aave challenges restraining orders as it seeks to protect users

In its emergency motion, Aave argues that the court should vacate the restraining notice because the alleged ownership transfer does not follow the legal logic of property rights. The motion contends that a thief cannot lawfully convert stolen assets into property that can be restrained or redirected by a third party, especially when the rightful ownership remains with the protocol’s users who were harmed during the exploit on April 18, 2026.

Another core contention is that North Korea is only suspected of involvement, and the claim that the thief’s acts automatically confer legitimate ownership is inconsistent with established principles of property and criminal law. Aave’s lawyers describe the claim as “defies logic, common sense and the law,” noting that the immobilized Ether belongs to Arbitrum DAO’s user base, not to any state actor or the alleged hacker group.

The emergency motion also raises concerns that allowing the restraining notice to stand could deter future recovery efforts for North Korea–related hacks by inviting additional legal challenges to recover funds. Aave warns that delays in unfreezing assets could hamper the protocol’s ability to restore value for users who relied on rsETH and other DeFi positions that may incorporate those assets as collateral. If the assets remain frozen, the firm argues, the broader DeFi ecosystem could face cascading collateral and liquidity issues that cannot be cured by damages alone.

“The immobilized assets do not belong to North Korea or any affiliated entities. Instead, the immobilized assets belong to the users of the Aave protocol who were victimized when a third-party thief effectively stole their assets during a cyber exploit April 18, 2026.”

The move comes as Aave seeks to ensure that a court decision—whichever way it rulings—does not set a precedent that could complicate future asset-recovery efforts across DeFi. If the court does not immediately vacate the notice, Aave has asked for a bond—reportedly $300 million—to sustain the restraining order until a ruling is reached.

Arbitrum DAO’s vote and the DeFi United effort

The Arbitrum DAO vote to unfreeze the 30,766 ETH is tied to a coordinated industry response named DeFi United, aimed at protecting rsETH holders and stabilizing the backing that supported rsETH after the incident. The initiative seeks to marshal community resources and align recovery efforts to restore trust and liquidity within the Arbitrum ecosystem and broader DeFi networks. The outcome of the vote, expected by May 7, could determine how quickly a significant tranche of Ether could be redirected to affected users and how much leverage the DeFi community has in guiding asset recovery during a legal dispute.

The debate underscores the tension between legal seizures or restraints tied to high-profile cyber incidents and the operational realities of DeFi protocols, which rely on the trust and accessibility of user funds. Proponents of unfreezing the Ether argue that rapid action is necessary to prevent further value erosion and to fulfill promises made to rsETH holders who may have relied on the asset’s corroborated backing. Critics worry about potential misuse or setting a precedent that could tempt external actors to cause disruption in the service of complex legal battles.

Legal backdrop and what it means for DeFi recovery efforts

Gerstein Harrow has built a portfolio of cases where they claim an interest in funds allegedly stolen in North Korea–linked incidents and subsequently frozen by crypto firms. The framework of these cases includes earlier disputes over assets linked to the 2023 Heco Bridge hack and the 2025 Bybit exploit. The firm’s approach—asserting ownership rights on behalf of plaintiffs tied to state-backed or state-actor–assisted hacks—has drawn responses from affected protocols that argue such claims risk overreach and misalign with the actual ownership landscape of DeFi assets.

Aave’s legal response emphasizes that the chain of ownership, especially in a decentralized setting, does not automatically transfer to third parties based on circumstantial attribution. The case hinges on whether a restraining notice can be sustained when the underlying premise is contested, and whether a court should permit continued immobilization of assets intended to restore value to users who were harmed by a criminal act. The outcome could influence how DeFi protocols navigate similar recoveries in the future, particularly when the alleged perpetrators are subject to jurisdictional complexities or international sanctions considerations.

As the hearing date remains unannounced, observers are watching not only the immediate fate of the Arbitrum Ether in question but also how courts will handle asset-freeze requests in cross-border, high-stakes cybercrime scenarios. The proceedings could shape how quickly DeFi projects can mobilize recovered assets to support token holders and maintain collateral integrity across ecosystems.

Context and precedent worth watching

Beyond the current dispute, the legal strategies employed by Gerstein Harrow reflect a broader pattern of claims aimed at recovering stolen crypto, especially in cases where wrongdoing is attributed to state actors or state-backed entities. The linkage to North Korea’s alleged involvement has been a recurring theme in related coverage and legal filings, underscoring the challenge of attributing cyber theft in a global, decentralized market.

For investors and builders, the key takeaway is that the legal status of recovered assets—whether they can be restrained, redirected, or used to compensate victims—depends on nuanced interpretations of ownership, theft, and the jurisdiction in which disputes are heard. The Aave motion and the Arbitrum DAO vote illustrate how the industry is trying to balance rapid value restoration for users with complex, sometimes speculative, legal claims. The coming weeks will reveal whether the court grants temporary relief, vacates the notice, or imposes further conditions on asset handling during ongoing litigation.

As a reminder of the ongoing legal landscape, the case references publicly available materials, including the underlying court filings and related analyses. For instance, the CourtListener filing referenced by the parties provides detailed context on the restraining notice and the arguments presented by both sides. Meanwhile, industry observers note that the debate over NK attribution remains central to how aggressively courts will weigh similar requests in the future.

Readers should monitor the next scheduled developments: a judge’s ruling on the emergency motion and the May 7 conclusion of the Arbitrum DAO vote, both of which could recalibrate expectations for asset recovery programs across DeFi and impact how protocols approach recoveries in future incidents.

Source notes: The Kelp DAO incident and the 30,766 ETH figure are tied to the ongoing recovery effort. Aave’s position is documented in its emergency filing, which argues against the restraining notice on grounds of ownership and identity attribution. Related coverage includes references to DeFi United’s rsETH restoration plan and prior cases pursued by Gerstein Harrow, such as the Heco Bridge and Bybit exploits.