Aave Goes to Court Wednesday to Block a $71M North Korea Crypto Seizure

Key Highlights

• Aave LLC filed an emergency motion to block the seizure of approximately $71 million in ETH frozen on Arbitrum after the April KelpDAO exploit
• The funds were frozen by Arbitrum’s Security Council as part of the KelpDAO recovery process and were slated to be returned to affected users
• Law firm Gerstein Harrow filed a restraining order on behalf of North Korean terrorism victims holding $877 million in unpaid judgments against the regime
• Aave argues the frozen funds belong to innocent protocol users, not North Korea, and that treating stolen assets as the thief’s property upends basic property law
• A court hearing is scheduled for Wednesday, May 7, 2026

A court in the United States is scheduled to hear an emergency motion on Wednesday, May 7, 2026, that has produced one of the most legally unusual disputes in DeFi’s history. On one side: Aave LLC, arguing that $71 million in ETH frozen on Arbitrum belongs to innocent protocol users and must be returned to them. On the other: a law firm representing victims of North Korean terrorism, arguing that the same funds are proceeds of a Lazarus Group hack and should be seized to partially satisfy $877 million in unpaid court judgments against the North Korean regime.

Both sides have legitimate legal arguments. The judge on May 7 will have to resolve a property law question that no court has previously addressed in a DeFi context: when stolen digital assets are intercepted before the thief can launder them, who do they legally belong to?

How the Funds Got Frozen

The $71 million in dispute traces back to the April 2026 KelpDAO exploit. KelpDAO was drained in a cross-chain bridge verification exploit that removed approximately $292 million from the liquid restaking protocol. As the stolen funds moved through the cross-chain infrastructure, a portion, approximately $71 million equivalent in ETH, was identified and intercepted before it could reach the laundering stage. Arbitrum’s Network Security Council froze the funds using emergency governance powers available under Arbitrum’s network architecture.

Aave was involved because the attack also used improperly valued rsETH as collateral on Aave to extract additional liquidity from the protocol during the exploit window. The frozen funds represent a portion of the assets that Aave’s recovery team and the Arbitrum Security Council had been working to return to users affected by the exploit. A coordinated recovery process was underway. Then the restraining order arrived.

The Legal Argument for Seizure

Gerstein Harrow is the law firm representing the plaintiffs in this case. The plaintiffs hold court judgments totaling more than $877 million against North Korea related to terrorism and abduction cases dating back to incidents between 2010 and 2020. North Korea has not paid any of these judgments. Under US law, creditors with valid judgments against a foreign state can seek to satisfy those judgments by seizing assets that are traceable to the judgment debtor, including assets that have been moved through third parties.

The firm’s argument is that the frozen ETH is traceable to the KelpDAO exploit, which it contends was carried out by North Korea’s Lazarus Group. If the court accepts that the funds are DPRK-attributable proceeds, the plaintiffs have a legal basis to claim the funds as partial satisfaction of their unpaid judgments. The $71 million would represent less than 10% of the total unpaid judgment amount, but it would be a meaningful precedent for seizing crypto assets as judgment recovery.

Aave’s Counter-Argument

Aave’s emergency motion makes a straightforward property law argument. When an asset is stolen, the thief does not acquire legal title to the stolen property. The property continues to belong to the victim of the theft. The frozen ETH, Aave argues, was stolen from KelpDAO users and Aave protocol users. The theft does not create DPRK ownership of the funds; it creates DPRK liability for the theft. Seizing the funds and directing them to a third party creditor of the thief rather than to the actual victims would take stolen property away from the people it was stolen from and give it to a different group of people who have a valid but unrelated claim against the thief.

Aave also raises a systemic stability argument. The company warns that keeping the funds frozen beyond the timeline required for the recovery process could trigger cascading liquidations and broader instability in decentralized finance markets that depend on the frozen assets as collateral. The recovery process that Arbitrum and Aave designed was time-sensitive: funds frozen longer than the planned recovery window create secondary protocol risks that the emergency governance action was not designed to accommodate.

The Lazarus Group Attribution Question

A significant threshold issue in the May 7 hearing is whether the court can make a determination about Lazarus Group attribution at the emergency hearing stage. Blockchain intelligence firms including TRM Labs have attributed the KelpDAO exploit to DPRK-linked actors with high confidence, citing on-chain behavioral patterns consistent with prior Lazarus Group operations and the subsequent movement of funds through infrastructure previously used in DPRK-linked laundering. TRM Labs’ May 2 report attributed 76% of all crypto theft value in 2026 to North Korean actors, with KelpDAO identified as one of the two major April attacks.

Private sector attribution, however credible, is not the same as a court finding. The May 7 hearing is an emergency proceeding focused on whether the restraining order should remain in place while the full merits are litigated. A ruling in Aave’s favor would not be a finding that the funds are unconnected to North Korea. It would be a finding that the plaintiffs have not yet met the standard required for a pretrial asset freeze that prevents an alternative use of the funds.

What Happens if Aave Loses

If the court upholds the restraining order and ultimately rules that the frozen ETH can be seized to satisfy the North Korea judgments, several consequences follow. The affected KelpDAO and Aave users who expected to receive those funds in the recovery process would receive nothing, or less than they were owed. The DeFi industry would face a new category of legal risk: that frozen funds recovered by Security Councils in exploit recoveries can be redirected to third parties with no connection to the original exploit.

That risk, if established as legal precedent, would change how Arbitrum and other chains with emergency governance powers approach exploit recovery. A Security Council that freezes funds in good faith to return them to exploit victims would need to account for the possibility that a creditor of the alleged attacker could redirect those funds to a different destination. The incentive to use emergency governance powers for recovery at all would be substantially reduced.

What Happens if Aave Wins

A ruling in Aave’s favor would allow the recovery process to proceed and establish that pretrial seizure of DeFi recover funds requires a higher evidentiary standard than the plaintiffs have met. The KelpDAO recovery process could then return the funds to the affected users on the original timeline. It would not be a ruling on the North Korea attribution question or on the underlying merits of the plaintiffs’ judgment enforcement claim. The plaintiffs would retain their right to pursue other DPRK-attributable assets through separate proceedings.

The TCB View

The Aave versus Gerstein Harrow case is the legal edge of a question that the DeFi industry has been avoiding for years: when governments or third parties with valid legal claims intervene in the aftermath of a crypto hack, who does the recovered property actually belong to? The property law answer is intuitive: stolen property belongs to the theft victims, not the thief, and not the thief’s creditors. But intuitive answers in law require a court to say so. The May 7 hearing is the first step toward that ruling. As the CLARITY Act moves toward markup with a new regulatory framework for the industry, the Aave case is a reminder that legislative clarity does not resolve the existing legal uncertainties that have accumulated in the absence of that framework. Some of those uncertainties will only be resolved by courts, one case at a time. The outcome on May 7 will be watched carefully by every DeFi protocol that participates in cross-chain governance and has ever considered using emergency powers to freeze exploit proceeds.