Judge Approves Aave Transfer of $71 Million ETH Linked to North Korea Hack

Margaret Garnett approved the transfer of frozen exploit-linked funds on Arbitrum to Aave, though the legal freeze will remain attached to the assets as plaintiffs in a terrorism-related case continue pursuing their claims.

A federal judge in Manhattan has allowed Aave’s recovery process to continue following last month’s North Korea-linked rsETH exploit, permitting the transfer of $71 million in frozen Ether from Arbitrum while still maintaining the legal claims tied to victims of North Korean terrorism.

In a two-page order released late Friday in the US, Margaret Garnett revised an earlier restraining notice issued to the Arbitrum DAO, allowing an onchain governance vote to move the frozen Ether to a wallet managed by Aave LLC.

The order also protects participants from legal liability under the restraining notice, stating that anyone involved in initiating, approving, or taking part in the transfer process would not be considered in violation of the asset freeze.

Arbitrum DAO Vote Remains Key to Aave Recovery Plan

Margaret Garnett’s decision came after an earlier offchain Snapshot temperature check showed strong support from Arbitrum DAO delegates for returning the frozen Ether under Aave’s wider recovery strategy. However, the transfer itself still depends on a separate binding onchain governance vote before it can move forward.

The ruling eased an immediate dispute that had threatened to disrupt a coordinated DeFi recovery process after attorney Charles Gerstein, representing families owed nearly $877 million in unpaid terrorism judgments against North Korea, argued that the frozen Ether could potentially be seized because the exploit was widely linked to the Lazarus Group, a cyber group believed to operate with support from Pyongyang.

What Comes Next Beyond the Arbitrum Dispute

Charles Gerstein’s action against Arbitrum DAO aligns with a wider legal effort aimed at tracking and pursuing assets linked to North Korea as they appear across decentralized finance infrastructure.

In a separate lawsuit filed in January, several of the same terrorism judgment creditors involved in the case against Arbitrum DAO also sued Railgun DAO, claiming the privacy-focused protocol enabled actors linked to North Korea to transfer funds that should have remained frozen and accessible to creditors.

At the time, the plaintiffs alleged that hackers linked to North Korea used Railgun DAO to launder funds stolen in earlier cyberattacks, including the $1.5 billion Bybit exploit, and argued the protocol should have frozen the assets instead of allowing them to be transferred further.

They argued that once wallets controlled by the North Korea regime began transferring funds through the protocol, those assets became possible targets for legal recovery efforts.

In March, the plaintiffs asked a federal court clerk in Washington to enter a default against Railgun DAO, claiming the protocol failed to respond to the lawsuit after being formally served. The complaint also names Digital Currency Group, alleging the firm became involved in the DAO’s governance and economic structure after purchasing $10 million worth of Railgun governance tokens in 2022.

In February, the plaintiffs also sought to secure Tether that the US government had previously attempted to seize through a forfeiture request.