North Korea terror victims escalate fight to seize $71 million from Aave hack

In a 30-page response filed Tuesday, attorneys for victims of three North Korea terrorism cases reframed the April 18 Aave hack as fraud rather than theft — a distinction that could give the attackers legal title to the borrowed crypto.

What to know:

• Lawyers for victims of North Korean terrorism now argue that April’s $71 million rsETH incident on Aave was fraud rather than theft, in a bid to preserve a court order freezing the funds.
• The filing invokes the Terrorism Risk Insurance Act to claim the frozen ether as North Korean state property and questions whether Aave has standing to challenge the freeze given its own terms saying it does not control user assets.
• The dispute stems from a cross-chain bridge exploit attributed to North Korea’s Lazarus Group that drained about $230 million from Aave, even as a separate DeFi recovery fund has raised more than four times the $71 million at issue, ahead of a May 6 federal court hearing in Manhattan.

Lawyers seeking to seize $71 million in frozen ether for victims of North Korean terrorism changed their legal strategy Tuesday, arguing in a new court filing that the April 18 rsETH exploit was not theft but fraud, directly countering Aave’s attempt to void a restraining notice blocking the release of the assets.

In a 30-page opposition brief filed in the Southern District of New York, a lawyer representing the North Korean terror victims argues the exploit was not a smash-and-grab theft but a fraudulent lending transaction, and that under longstanding U.S. law, fraudsters who acquire property through deception can obtain legal title to it, even if that ownership is later reversible.

"What actually happened is that North Korea borrowed assets from users of the 'Aave Protocol' and did not pay it back, and when the 'Aave Protocol' sought to liquidate North Korea's collateral, the 'Aave Protocol' unhappily discovered that the collateral was worthless," the new filing reads.

"The law is crystal clear that a fraud victim passes title, not merely possession, to a fraudster… Charles Ponzi obtained, through his now-eponymous scheme, 'defeasible title' to his victims' cash," it continues.

The dispute traces to a cross-chain bridge exploit last month that drained roughly $230 million from Aave, the largest decentralized lending protocol by total value locked.

An attacker, widely attributed to North Korea’s Lazarus Group by forensics firms including Chainalysis and TRM Labs, minted unbacked rsETH tokens, used them as collateral on Aave’s lending markets, and borrowed real ether against the worthless deposits.

Developers tied to the Arbitrum blockchain later intercepted about $71 million before it could be cashed out.

The filing also escalates the dispute beyond New York property law, invoking the Terrorism Risk Insurance Act (TRIA), a post-9/11 federal law that allows people who win court judgments against state sponsors of terrorism to collect those judgments from any U.S.-held property belonging to the country in question.

If the court accepts that theory, Aave’s earlier arguments about New York property law may matter less.

The filing also asks whether Aave has legal standing to challenge the freeze at all, citing the company’s own terms of service, which state that it does not have “possession, custody or control” over user assets, a core aspect of decentralized finance.

Lawyers also pointed out in the filing that the affected users may not need the frozen ether at all. DeFi United, an industry-led recovery fund Aave itself is part of, has raised $327.95 million as of Tuesday morning — more than four times the disputed $71 million.

A hearing is scheduled for Wednesday, May 6, in a Manhattan federal court.

More For You

Speakers point to complexity, poor user experience and lack of transparency as key obstacles for mainstream users.

What to know:

• Panelists at Consensus 2026 said trust remains the main obstacle to wider crypto adoption, driven by complexity, jargon and misinformation.
• Speakers from Circle, U.S. Bank and ChangeNOW argued that trust is earned through clear, simple user experiences, strong customer support and visible human interaction rather than technical claims alone.
• The...

XRP above $1.42 as traders watch 2025 breakout pattern that led to 66% rally

2 hours ago

Bitcoin tops $81,000 as Strategy mulls selling its BTC to fund dividend obligations

3 hours ago

Michael Saylor's Strategy signals potential bitcoin sale to fund dividends obligations

7 hours ago

Trust in crypto remains biggest barrier to adoption, say Consensus Miami 2026 panelists

8 hours ago

The world's entire economy will be tokenized, says Consensys’ Joseph Lubin

9 hours ago

It's transparency, not tech alone, that drives crypto adoption, panelists tell Consensus Miami

9 hours ago

Consensus Miami Day 1: Real-time coverage and highlights from on the ground

17 hours ago

Ripple CEO Brad Garlinghouse says Clarity better than chaos as Senate hits key moment

14 hours ago

Figure targets Fannie Mae and Freddie Mac in mortgage push, citing massive cost cuts for borrowers

14 hours ago

Coinbase cuts 14% of staff as AI reshapes how crypto companies operate

19 hours ago

Strategy posts $12.54 billion Q1 loss on declining bitcoin price

11 hours ago

Crypto.com’s high-rolling head of marketing to leave after almost six years

17 hours ago