Aave

Arbitrum

DeFi

motion

Sanctum

Decentralized finance protocol Aave filed an emergency motion on Monday in New York to vacate a restraining notice from a US law firm aimed at blocking Arbitrum DAO from transferring 30,766 frozen Ether to the victims of the Kelp exploit.&nbsp;
Gerstein Harrow LLP <a href="https://cointelegraph.com/news/law-firm-tries-to-claim-kelp-exploit-eth-because-clients-owed-by-dprk" rel="noopener noreferrer nofollow">served Arbitrum DAO with a restraining notice on Friday</a>, arguing its clients are owed over $877 million in default judgments against North Korea. The law firm claims the North Korean hacker group behind the Kelp exploit had possession of the tokens, giving its clients a legal claim over the Ether.
Aave <a href="https://storage.courtlistener.com/recap/gov.uscourts.nysd.653423/gov.uscourts.nysd.653423.42.0.pdf" rel="noopener noreferrer nofollow">filed</a> the emergency motion in a New York district court, arguing that a thief doesn’t gain lawful ownership of property by stealing it. It also argued that North Korea is only suspected of being part of the theft, and that the law firm's argument “defies logic, common sense and the law.”
The Arbitrum DAO has been voting on whether to <a href="https://cointelegraph.com/news/arbitrum-dao-asked-to-unfreeze-30k-eth-tied-to-kelp-hacker-direct-them-to-defi-united" rel="noopener noreferrer nofollow">release the Ether to assist DeFi United</a>, an industrywide coordination effort to make rsETH holders whole and help restore rsETH's backing following the $292 million Kelp DAO hack on April 18. Voting ends Thursday.&nbsp;
<img alt="Aave files emergency motion to lift restraining notice on frozen ETH" height="796" src="https://payload.lum-tri.org/api/media/file/pasted-image-299.png?prefix=media%2Fcontent" width="731">
Source: <a href="https://x.com/aave/status/2051329772190347560?s=46&amp;t=MuRujqZUAz3TQE1vmr3c6A" rel="noopener noreferrer nofollow">Aave</a>
<h2 id="delay-will-cause-irreparable-harm-to-aave-crypto-ecosystem">Delay will cause “irreparable harm” to Aave, crypto ecosystem</h2>
Aave argued that if the court upholds Gerstein Harrow's notice, it could deter future recovery efforts for North Korea-related hacks because of the possibility of additional legal challenges to recover funds. It further argued that it could incentivize bad actors to target more crypto protocols.
Aave's lawyers also warned that the delay is causing “irreparable harm” to the protocol, its users and the wider DeFi community, “none of which can be later cured by monetary damages.”
“If the immobilized assets remain subject to a freeze and are not made available to restore value to Aave protocol users, the entire DeFi ecosystem risks being destabilized,” Aave's lawyers said.
<blockquote>
 “While Aave protocol users cannot retrieve their assets from the Aave protocol, if those assets were being used for collateral for other positions elsewhere then continued restraint on the immobilized assets may render those users unable to meet their related collateral obligations.”
</blockquote>
<img alt="Aave files emergency motion to lift restraining notice on frozen ETH" height="550" src="https://payload.lum-tri.org/api/media/file/pasted-image-300.png?prefix=media%2Fcontent" width="704">
Aave said that if a court upholds Gerstein Harrow's notice, it could incentivize bad actors to target more crypto protocols. Source: <a href="https://storage.courtlistener.com/recap/gov.uscourts.nysd.653423/gov.uscourts.nysd.653423.42.0.pdf" rel="noopener noreferrer nofollow">CourtListener</a>
They further argued against Gerstein Harrow’s claim that its clients have a right to the frozen Ether and also said the case is based on unsupported conjecture <a href="https://cointelegraph.com/features/north-korean-hackers-578m-april-kelp-dao-exploit" rel="noopener noreferrer nofollow">that the thief is North Korea</a>.&nbsp;
“Plaintiffs in this case showed up, contending – based on conjecture from posts on the internet – that the thief was North Korea, and that by stealing the assets for a few hours, North Korea somehow became the rightful owner of those assets such that Plaintiffs here could restrain them for their own purposes,” lawyers for Aave said.
<blockquote>
 “The immobilized assets do not belong to North Korea or any affiliated entities. Instead, the immobilized assets belong to the users of the Aave protocol who were victimized when a third-party thief effectively stole their assets during a cyber exploit April 18, 2026.”&nbsp;
</blockquote>
Related: <a href="https://cointelegraph.com/news/north-korean-hackers-malware-crypto-fintech-social-engineering" rel="noopener noreferrer nofollow">Google Cloud flags North Korea-linked crypto malware campaign</a>
If the court can’t immediately vacate the notice, Aave's lawyers are requesting that Gerstein Harrow pay a $300 million bond to maintain the restraining notice until a decision is reached.
A judge hasn't ruled on the emergency motion yet, and a hearing date hasn't been scheduled.&nbsp;
Gerstein Harrow has filed similar cases in the past, arguing its clients have a claim to funds stolen by North Korea and frozen by crypto firms, <a href="https://gerstein-harrow.com/Cases/Doc.%208%20Han%20Kim%20Claim%20.pdf" rel="noopener noreferrer nofollow">including</a> assets from the 2023 Heco Bridge hack and the 2025 <a href="https://gerstein-harrow.com/Cases/Doc.%204%20Circle%20Turnover%20Memo%20of%20Law.pdf" rel="noopener noreferrer nofollow">Bybit</a> exploit.
Magazine: <a href="https://cointelegraph-magazine.com/defis-billion-dollar-secret-the-insiders-responsible-for-hacks/" rel="noopener noreferrer nofollow">DeFi’s billion-dollar secret: The insiders responsible for hacks</a>&nbsp;&nbsp;

Aave files emergency motion to lift restraining notice on frozen ETH

Table of Contents

Cointelegraph

Other articles published on May 5, 2026

Join our free newsletter for daily crypto updates!