Decentralized finance protocol Aave filed an emergency motion on Monday in New York to vacate a restraining notice from a US law firm aimed at blocking Arbitrum DAO from transferring 30,766 Ether to the victims of the Kelp exploit.
Gerstein Harrow LLP served Arbitrum DAO with a restraining notice on Friday, arguing its clients are owed over $877 million in default judgments against North Korea. The law firm claims the North Korean hacker group behind the Kelp exploit had possession of the tokens, giving its clients a legal claim over the Ether.
Aave filed the emergency motion in a New York district court, arguing that a thief doesn’t gain lawful ownership of property by stealing it. It also argued that North Korea is only suspected of being part of the theft, and that the law firm’s argument “defies logic, common sense and the law.”
The Arbitrum DAO has been voting on whether to release the Ether to assist DeFi United, an industrywide coordination effort to make rsETH holders whole and help restore rsETH’s backing following the $292 million Kelp DAO hack on April 18. Voting ends May 7.
Source: Aave
Delay will cause “irreparable harm” to Aave, crypto ecosystem
Aave argued that if the court upholds Gerstein Harrow’s notice, it could deter future recovery efforts for North Korea-related hacks because of the possibility of additional legal challenges to recover funds. It further argued that it could incentivize bad actors to target more crypto protocols.
Aave’s lawyers also warned that the delay is causing “irreparable harm” to the protocol, its users and the wider DeFi community, “none of which can be later cured by monetary damages.”
“If the immobilized assets remain subject to a freeze and are not made available to restore value to Aave protocol users, the entire DeFi ecosystem risks being destabilized,” Aave’s lawyers said.
“While Aave protocol users cannot retrieve their assets from the Aave protocol, if those assets were being used for collateral for other positions elsewhere then continued restraint on the immobilized assets may render those users unable to meet their related collateral obligations.”
Aave said that if a court upholds Gerstein Harrow’s notice, it could incentivize bad actors to target more crypto protocols. Source: CourtListener
They further argued against Gernstein Harrow’s claim that its clients have a right to the frozen Ether and also said the case is based on unsupported conjecture that the thief is North Korea.
“Plaintiffs in this case showed up, contending – based on conjecture from posts on the internet – that the thief was North Korea, and that by stealing the assets for a few hours, North Korea somehow became the rightful owner of those assets such that Plaintiffs here could restrain them for their own purposes,” lawyers for Aave said.
“The immobilized assets do not belong to North Korea or any affiliated entities. Instead, the immobilized assets belong to the users of the Aave protocol who were victimized when a third-party thief effectively stole their assets during a cyber exploit April 18, 2026.”
Related: Google Cloud flags North Korea-linked crypto malware campaign
If the court can’t immediately vacate the notice, Aave’s lawyers are requesting that Gerstein Harrow pay a $300 million bond to maintain the restraining notice until a decision is reached.
A judge hasn’t ruled on the emergency motion yet, and a hearing date hasn’t been scheduled.
Gerstein Harrow has filed similar cases in the past, arguing its clients have a claim to funds stolen by North Korea and frozen by crypto firms, including assets from the 2023 Heco Bridge hack and the 2025 Bybit exploit.
Magazine: DeFi’s billion-dollar secret: The insiders responsible for hacks
