Leading decentralized lending platform Aave has asked a US federal court to block an attempt by North Korean terrorism victims to seize around $71 million in cryptocurrency frozen after last month’s rsETH-related exploit, escalating a dispute that has already divided Arbitrum’s governance.
The filing, filed Monday in the Southern District of New York, seeks to vacate a restraining notice served on Arbitrum DAO by attorneys representing judgment creditors of the Democratic People’s Republic of Korea. Aave argues that the assets belong to the users of its protocol, not North Korea, and warns that keeping them frozen risks “irreparable damage” to the platform and the broader DeFi ecosystem.
At the center of the fight is 30,765 ETH that the Arbitrum Security Council froze after the April exploit, when attackers used improperly valued or unbacked rsETH as collateral on Aave, contributing to a situation that plaintiffs say resulted in the withdrawal of approximately $230 million in ETH from the Aave Protocol. Some of those funds were later intercepted and frozen in Arbitrum, with plans to return them to affected users as part of a coordinated recovery effort.
The dispute centers on whether stolen property held by hackers for a short period becomes their legal property.
The plaintiffs, three groups of judgment creditors holding $877 million in damages awards against North Korea, argue yes, and that because the rsETH attackers are widely believed to be linked to Pyongyang’s Lazarus Group, the recovered ether can be claimed against those decades-old judgments.
Aave’s lawyers call that theory “totally wrong” and warn that it would punish innocent users while rewriting basic property law.
Aave’s move challenges that theory directly. The filing argues that restricted ETH “belongs[s] to completely innocent third parties,” not to North Korea, and that even if a thief briefly held the assets, that does not confer legal ownership.
He also questions the underlying attribution, calling claims that the exploit was carried out by DPRK actors “conjecture” based on unverified reports.
Aave is asking the court to immediately lift the restriction notice or, at a minimum, suspend it while the case is heard.
Aave says keeping funds frozen through the restriction notice could deepen losses and destabilize DeFi markets already strained by the exploit. The document warns that this “increases the likelihood of cascading liquidations, sustained liquidity outflows, and irreversible changes in users’ positions,” a chain reaction that the industry has been trying to avoid for two weeks.
The result could have consequences far beyond this case. If courts allow third-party creditors to claim seized or recovered cryptocurrencies, it could deter future rescue efforts and complicate how the industry responds to attacks, where speed and coordination are often the only tools to limit damage.
