Emergency legal filing seeks removal of restraining order blocking frozen Ethereum
In an emergency court filing, Aave seeks to overturn a restraining order issued by Gerstein Harrow LLP that prevents Arbitrum DAO from releasing frozen Ether connected to the Kelp hack, with the law firm asserting its clients hold legal rights based on alleged North Korean involvement.
On Monday, the decentralized finance platform Aave submitted an emergency legal motion to a New York court requesting the removal of a restraining notice issued by Gerstein Harrow LLP, a United States law firm that is preventing Arbitrum DAO from distributing 30,766 Ether to those affected by the Kelp exploit.
Last Friday, Gerstein Harrow LLP delivered a restraining notice to Arbitrum DAO, contending that their clients hold default judgments exceeding $877 million against North Korea. According to the firm's position, the North Korean hacking group responsible for the Kelp exploit had control of the digital assets, thereby establishing their clients' legal entitlement to the Ethereum in question.
The emergency filing submitted by Aave to a district court in New York maintains that theft does not confer legitimate ownership rights to stolen property. The filing also emphasizes that North Korean involvement remains speculative at this stage, and characterizes the law firm's legal position as contradicting "logic, common sense and the law."
Members of the Arbitrum DAO are currently engaged in a voting process to determine whether the Ether should be released to support DeFi United, a collaborative industry initiative designed to compensate rsETH holders and restore rsETH's value following the $292 million Kelp DAO security breach that occurred on April 18. The voting period concludes on May 7.
Delay will cause "irreparable harm" to Aave, crypto ecosystem
In its legal arguments, Aave contends that allowing Gerstein Harrow's notice to stand could create a chilling effect on future fund recovery initiatives related to North Korean hacking incidents, as recovery efforts would face the threat of similar legal obstacles. The protocol additionally argues that such a precedent might encourage malicious actors to launch attacks against additional cryptocurrency platforms.
Legal representatives for Aave have also cautioned that the ongoing delay is inflicting "irreparable harm" upon the protocol, its user base, and the broader decentralized finance ecosystem, "none of which can be later cured by monetary damages."
"If the immobilized assets remain subject to a freeze and are not made available to restore value to Aave protocol users, the entire DeFi ecosystem risks being destabilized," Aave's lawyers said.
"While Aave protocol users cannot retrieve their assets from the Aave protocol, if those assets were being used for collateral for other positions elsewhere then continued restraint on the immobilized assets may render those users unable to meet their related collateral obligations."
Aave's legal team has challenged Gernstein Harrow's assertion that their clients possess legitimate claims to the frozen Ethereum, further noting that the entire case rests on unsubstantiated speculation linking the perpetrator to North Korea.
"Plaintiffs in this case showed up, contending – based on conjecture from posts on the internet – that the thief was North Korea, and that by stealing the assets for a few hours, North Korea somehow became the rightful owner of those assets such that Plaintiffs here could restrain them for their own purposes," lawyers for Aave said.
"The immobilized assets do not belong to North Korea or any affiliated entities. Instead, the immobilized assets belong to the users of the Aave protocol who were victimized when a third-party thief effectively stole their assets during a cyber exploit April 18, 2026."
Should the court be unable to vacate the notice immediately, legal counsel for Aave has requested that Gerstein Harrow be required to post a $300 million bond as a condition for maintaining the restraining notice pending a final determination.
As of now, no judicial ruling has been issued regarding the emergency motion, and the court has not yet set a date for a hearing on the matter.
This is not the first time Gerstein Harrow has pursued such legal action, having previously filed similar cases claiming their clients possess rights to assets stolen by North Korea and subsequently frozen by cryptocurrency companies, including funds from the 2023 Heco Bridge hack and the 2025 Bybit exploit.