According to AMBCrypto, Aave has filed an emergency motion to vacate a restraining notice that has frozen approximately $71 million in ETH recovered from the 18 April exploit. The motion was filed in the U.S. District Court for the Southern District of New York, arguing that the assets belong to victims of the exploit and should be returned rather than seized. The dispute stems from a restraining notice issued on 1 May against the Arbitrum DAO, with plaintiffs attempting to seize the funds to satisfy unpaid judgments against the Democratic People's Republic of Korea.
According to TRM Labs data, actors linked to the Democratic People's Republic of Korea were responsible for approximately $577 million in stolen cryptocurrency between January and April 2026. As reported by TRM Labs, this figure represents 76% of all global hacking losses during the four-month period. The data shows that two major April exploits drove the majority of these losses, including a $292 million breach of KelpDAO and a $285 million attack on Drift Protocol. The Lazarus Group, a notorious hacking collective, is primarily linked to these incidents.
According to Korean Central News Agency, a spokesperson for North Korea's Foreign Ministry dismissed the accusations as 'absurd defamation' and described them as a 'political tool' used by the United States. The spokesperson argued that it was unreasonable for Washington, which they described as having the world's most advanced cyber capabilities, to present itself as the 'world's greatest victim'. The ministry stated that the country would take 'all necessary measures' to defend its interests.
Data compiled by TRM Labs shows a dramatic increase in North Korea's share of global crypto theft over recent years, rising from below 10% in 2020 and 2021 to 64% in 2025, before reaching 76% in the first four months of 2026. According to TRM Labs, cumulative crypto theft attributed to the country has now exceeded $6 billion since 2017. The firm linked the KelpDAO exploit to TraderTraitor, an operation associated with the Lazarus Group, while noting that the Drift Protocol attack involved a separate subgroup under investigation. On March 13, the U.S. Department of the Treasury sanctioned six individuals and two entities tied to North Korean IT worker schemes that generated nearly $800 million in 2024.
The frozen ETH had been earmarked for return through a coordinated recovery initiative involving multiple DeFi participants, but the restraining notice has halted that process. As reported by AMBCrypto, Aave's filing warns that continued restraint could lead to wider disruptions, including liquidity stress and cascading effects across DeFi markets if users remain unable to access funds. The company is seeking an expedited hearing and temporary relief to allow the recovery process to continue, highlighting the tension between DeFi recovery efforts and U.S. court enforcement in cases involving North Korean cyber activities.
