Summary:

Aave files emergency motion to lift restraining notice blocking ~$71M in ETH.
Legal claim argues stolen funds cannot become lawful property of attacker or third parties.
Arbitrum DAO vote is ongoing to release funds to Kelp exploit victims.
Delay could harm users and weaken broader DeFi recovery efforts.
Case raises deeper questions about legal claims over hacked crypto assets.

A legal battle is now unfolding around one of the most sensitive issues in crypto that who actually owns stolen funds after an exploit. Aave has filed an emergency motion in a New York court, pushing to remove a restraining notice that is currently blocking the transfer of 30,766 ETH roughly $71 million - tied to recovery efforts following the Kelp DAO exploit. The funds were frozen after a notice from law firm Gerstein Harrow LLP, which claims its clients have rights to the assets due to unrelated legal judgments involving North Korea. At the center of this dispute is a simple but high-stakes argument. Aave is saying the law firm's position doesn't hold up. In their view, stolen assets don't suddenly become the legal property of whoever briefly controls them. Aave made that stance clear publicly:

"Aave LLC has filed an emergency motion to vacate a restraining notice served on Arbitrum DAO on May 1, 2026 that attempts to seize approximately $71 million in ETH belonging to victims of the April 18 exploit. A thief does not gain lawful ownership of stolen property simply by taking it, and the law is clear on this. Those assets were recovered to be returned to users victimized in the April 18, 2026 exploit. Freezing them harms the very people this recovery effort is designed to protect." Source

That statement captures the core tension. On one side, a coordinated effort to return funds to victims. On the other, a legal claim that could redirect those funds elsewhere. Meanwhile, Arbitrum DAO is already in the middle of a governance vote to release those funds as part of a broader recovery plan. The vote is scheduled to end on May 7, and the outcome could shape how decentralized governance interacts with traditional legal systems going forward.

Why This Case Goes Beyond Just One Exploit

Aave's legal team warned that allowing the restraining notice to stand could create long-term problems. If recovery funds can be frozen or redirected through external legal claims, protocols might hesitate to act quickly in future incidents. Their filing goes further, calling out the underlying assumption behind the claim:

"Plaintiffs in this case showed up, contending - based on conjecture from posts on the internet - that the thief was North Korea, and that by stealing the assets for a few hours, North Korea somehow became the rightful owner of those assets such that Plaintiffs here could restrain them for their own purposes," lawyers for Aave said.

Also added "The immobilized assets do not belong to North Korea or any affiliated entities. Instead, the immobilized assets belong to the users of the Aave protocol who were victimized when a third-party thief effectively stole their assets during a cyber exploit April 18, 2026." This line of argument highlights a key difference between traditional finance and crypto systems. In DeFi, funds can move quickly, exploits can happen across multiple protocols, and recovery often depends on coordination. If legal claims begin attaching to those flows mid-recovery, the process becomes slower and far more uncertain. Aave also stressed that the current delay is already having real consequences. According to its lawyers, keeping the funds frozen is causing "irreparable harm" not just to users but to the wider ecosystem. Their concern is that uncertainty around recovery could ripple across protocols, especially in cases where assets are interlinked through lending, staking, or liquidity pools. There's also a practical angle. If courts allow these types of claims, attackers could indirectly benefit. Bad actors might exploit legal gray areas, knowing that even recovered funds could be tied up for months or years.

What Happens Next for DeFi Recovery Efforts

For now, the situation remains unresolved. A judge has not yet ruled on the emergency motion, and no hearing date has been confirmed. If the court doesn't immediately lift the restraining notice, Aave has proposed an alternative - requiring Gerstein Harrow to post a $300 million bond to maintain the freeze while the case plays out. At the same time, the broader recovery effort continues. The frozen ETH is intended to support victims of the April 18 Kelp DAO exploit, which saw around $292 million drained. The funds represent a partial step toward restoring losses and stabilizing affected assets like rsETH.

Looking ahead, this case could set an important precedent. If the court sides with Aave, it reinforces the idea that stolen crypto remains tied to its original owners, even after moving through attacker wallets. If not, protocols may need to rethink how they approach recovery altogether. Either way, the outcome will likely shape how DeFi interacts with legal systems going forward - especially in cases involving cross-border actors, sanctions, and large-scale exploits. For now, the funds remain frozen, the vote is ongoing, and the industry is watching closely.