A legal battle in a U.S. federal court could determine whether funds recovered following a cyberattack can be redirected from their intended users.
In New York, Aave is petitioning a federal court to release approximately $71 million worth of cryptocurrency that remains frozen on the Arbitrum network. The firm argues these assets belong to its users rather than a hacker allegedly linked to North Korea, igniting a conflict between decentralized finance (DeFi) recovery initiatives and creditors pursuing longstanding claims against the nation.
A memorandum submitted by Aave on Monday states that a court-ordered freeze on Arbitrum—a layer-2 Ethereum network—is obstructing efforts to return funds seized after an exploit involving Kelp DAO’s rsETH token. Aave is urging the court either to immediately lift this freeze or require plaintiffs to secure a bond of at least $300 million if it persists.
“Following the breach, teams from the Aave Protocol community, the Arbitrum community, and other DeFi groups globally engaged in an effort known as ‘DeFi United’ to recover immobilized assets and restore stability across various protocols,” the filing notes.
The controversy originated from a hack in April targeting Kelp DAO, which allows Ethereum staking for rsETH tokens. The attackers deceived a cross-chain token system, generating counterfeit rsETH to borrow about $290 million.
Plaintiffs, who hold outstanding judgments against North Korea, contend that the hacker is likely connected to the Lazarus Group and assert that the seized assets should be considered North Korean property eligible for seizure.
“Although plaintiffs’ grievances against North Korea may be justified,” the document states, “AaveLLC firmly opposes any lawful claim that these grievances justify seizing assets belonging to blameless third parties—namely, users of the Aave software protocol (the ‘Aave Protocol’), who are entirely unconnected to any alleged misconduct and have no known ties to North Korea.”
While the identity of the hacker remains uncertain, the repercussions quickly spread. Users rushed to withdraw funds as liquidity dwindled, with critical lending pools reaching their limits rapidly. Within a brief period, billions departed from the platform, leaving some users unable to access their deposits.
Simultaneously, Arbitrum’s Security Council froze about 30,766 ETH—valued at roughly $71 million—which had been traced back to the exploit and placed it under governance control. These funds have now become central to the ongoing legal dispute.
In the following month, Aave, alongside Consensys, Lido, Compound, and the Avalanche Foundation, initiated a recovery campaign dubbed “DeFi United.” They amassed over $300 million to assist in restoring the value of rsETH and compensating for hack-related losses.
The filing also casts doubt on whether Arbitrum DAO can be legally recognized as an entity. Aave claims it lacks formal organizational status that would allow for service in the manner attempted by plaintiffs, potentially complicating legal proceedings.
In addition to this legal contention, Aave argues that the freeze exacerbates the repercussions of the Kelp DAO exploit.
“The true intent of the Restraining Notice against Arbitrum DAO is not to support global recovery efforts aiding Aave Protocol victims,” attorneys for the plaintiffs wrote. “Instead, it serves the opposite purpose.”