The frozen ETH traces back to the April 18 exploit of Kelp DAO's cross-chain bridge, which was attributed to North Korea's Lazarus Group and drained roughly $292 million in restaked ether. A U.S. District Court in the Southern District of New York issued the restraining order on May 1, after families holding unpaid U.S. terrorism judgments against North Korea argued the funds qualify as state-linked assets subject to seizure.

The Legal Collision

Aave's core argument is straightforward: stolen property cannot be legally transferred by the thief. The filing invokes the common law principle nemo dat quod non habet, meaning a thief does not own what he steals. Because the ETH was taken through criminal fraud, Aave contends that North Korean agents never held valid title to it and therefore it cannot be seized as a sovereign asset. Arbitrum delegate Zeptimus echoed the same logic in a governance forum post: "It's stolen property... a thief acquires no title."

On the other side, attorney Charles Gerstein filed on behalf of Han Kim and Yong Seok Kim, U.S. nationals whose relative was killed by Pyongyang in the Reverend Kim Dong Shik abduction case. Gerstein cited three existing federal judgments tied to Pyongyang: the 1972 Lod Airport massacre, the abduction and death of Reverend Kim Dong Shik, and North Korean weapons support during the 2006 Israel-Hezbollah War. His filings invoked New York creditor-enforcement statutes, the Foreign Sovereign Immunities Act, and the Terrorism Risk Insurance Act. The combined value of the terrorism judgments his clients hold totals approximately $877 million, not counting interest.

Attorney Gabriel Shapiro, in commentary published by Unchained Crypto, noted that the court order "carries significant legal weight, preventing Arbitrum from moving funds pending a divestiture hearing."

What Is at Stake for DeFi United

The frozen ETH was earmarked as the single largest block contribution to DeFi United, an industry-wide recovery coalition that Aave assembled in the weeks after the hack. The coalition has secured pledges totaling more than $303 million from more than a dozen contributors, including a proposed contribution of up to 250,000 ETH from the Aave DAO (subject to a final governance vote), 30,000 ETH from Consensys led by co-founder Joseph Lubin, a 30,000 ETH credit facility from Mantle, 5,000 ETH from EtherFi, and personal commitments from Aave founder Stani Kulechov. The coalition has also drawn cross-ecosystem support from the Avalanche Foundation, Solana Foundation, Circle Ventures, and Justin Sun, reflecting coordination that extends well beyond Ethereum.

Kelp DAO has separately recovered 73,700 ETH through direct clawback efforts, but a significant shortfall remains. The frozen 30,766 ETH held by Arbitrum's Security Council represents a critical portion of the gap still to be filled. Aave's own post-incident report estimated total bad debt at between $123.7 million and $230.1 million depending on how losses are distributed, and without the Arbitrum tranche the coalition faces a material deficit.

An Arbitrum community snapshot vote showed 99% support for releasing the funds, with a governance deadline set for May 7. That vote carries no weight while the restraining order stands.

How the Hack Unfolded

The Kelp DAO exploit began at 17:35 UTC on April 18. Attackers first launched a distributed denial-of-service attack on legitimate RPC nodes, forcing a failover to attacker-controlled servers and exploiting a centralized single-point-of-failure in the bridge's verifier network. Once in control of two RPC nodes, they injected a forged packet claiming to originate from Unichain, which convinced the Ethereum-side bridge adapter to release 116,500 rsETH without any corresponding burn on the source chain. Attackers deposited 89,567 rsETH as collateral on Aave and borrowed approximately 82,650 WETH and 821 wstETH before the protocol's Guardian module froze rsETH markets roughly one hour after the breach began.

Aave's total value locked fell from approximately $26.7 billion to roughly $17.7 billion within 48 hours, a drop of about 33%. The AAVE token declined around 16% in the same period and was trading near $92.47 as of May 4. Broader DeFi lost approximately $13.2 billion in total value locked across the two days following the attack.

Regional Exposure

The legal dispute has implications well beyond U.S. borders. Kelp DAO was co-founded by Amitej Gajjala, a graduate of IIT Madras, and Dheeraj Borra, a graduate of IIT Kharagpur, two of India's most prestigious engineering universities. The pair previously built Stader Labs, a multi-chain liquid staking protocol with more than $500 million in TVL. South Asian users who adopted rsETH partly on the strength of that founding team now have funds stranded in a dispute between DeFi recovery advocates and U.S. terrorism creditors. In India, where regulators already apply strict transaction-reporting requirements to crypto activity, a high-profile hack with North Korean attribution tied to an India-founded protocol is likely to supply fresh arguments for tighter DeFi oversight.

In Africa, where protocols like Aave serve users in Nigeria, Kenya, South Africa, and Ghana who have limited access to conventional lending infrastructure, the 100% utilization rate on affected WETH markets blocked withdrawals for days. If the recovery coalition falls short and losses are socialized across depositors, smaller retail participants on Arbitrum, Mantle, Linea, and Base will be hit hardest. For DeFi builders across the continent assessing cross-chain protocol risk, the cross-ecosystem composition of the DeFi United coalition is particularly relevant: the participation of the Avalanche Foundation, Solana Foundation, Circle Ventures, and Justin Sun alongside Ethereum-native contributors offers early evidence that coordinated recovery mechanisms can function across competing ecosystems.

What Comes Next

The emergency motion sets up what could become a defining precedent for how U.S. courts treat on-chain assets in DAO-controlled wallets. Legal observers have warned that individual members of Arbitrum's Security Council could face personal liability if the funds move while the order is in effect. As of publication, no hearing date had been publicly confirmed, but the May 7 governance deadline means the outcome could be forced within days. If Aave prevails, the DeFi United recovery effort moves forward. If the court sides with the terrorism creditors, the legal template for freezing DAO-held assets using existing creditor-enforcement statutes becomes substantially more credible, and every protocol with U.S.-linked infrastructure will need to account for that risk.