Leading decentralized lending platform Aave has asked a US federal court to block an attempt by victims of North Korean terrorism to seize around $71 million in crypto frozen after last month’s rsETH-related exploit, escalating a dispute that has already divided Arbitrum’s governance.
The filing, filed Monday in the Southern District of New York, seeks to vacate a restraining order given to Arbitrum DAO by lawyers representing judgment creditors in the Democratic People’s Republic of Korea. Aave claims the assets belong to users of its protocol, not North Korea, and warns that keeping them frozen risks “irreparable damage” to the platform and the wider DeFi ecosystem.
At the center of the battle is 30,765 ETH that Arbitrum’s Security Council froze after the exploit in April, when the attackers used improperly valued or unsupported rsETH as collateral for Aave, contributing to a situation that the plaintiffs claim resulted in approximately $230 million in ETH being withdrawn from the Aave protocol. Some of these funds were later intercepted and immobilized on Arbitrum, with plans to return them to affected users as part of a coordinated recovery effort.
The dispute centers on whether stolen property briefly held by hackers becomes their legal property.
The plaintiffs, three sets of judgment creditors who have $877 million in damages against North Korea, argue that it does — and that’s because the rsETH attackers are widely believed to be connected to Pyongyang’s Lazarus group, the recovered ether can be claimed against those decades-old judgments.
Aave’s lawyers call that theory “flat wrong” and warn that it would penalize innocent users while rewriting basic property rights.
Aave’s motion directly challenges that theory. The filing claims that the held ETH “belongs[s] to completely blameless third parties,” not to North Korea, and that even if a thief briefly possessed the assets, that does not confer legal ownership.
It also disputes the underlying attribution, calling claims that the exploit was carried out by DPRK actors “conjecture” based on unverified reports.
Aave asks the court to immediately lift the restraining order or at least to suspend it while the case is processed.
Aave says keeping the funds frozen via the hold notice could exacerbate losses and destabilize DeFi markets already strained by the exploit. The filing warns that this “increases the likelihood of cascading liquidations, sustained cash outflows and irreversible changes in user positions,” a chain reaction the industry has been trying to avoid for two weeks.
The outcome could have ramifications far beyond this case. If courts allow seized or recovered crypto to be claimed by outside creditors, it could deter future rescue efforts and complicate how the industry responds to hacks, where speed and coordination are often the only tools to limit the damage.
