Judge Allows Aave to Recover $71 Million in ETH Linked to North Korea Hack

The recovery process for nearly $71 million worth of ether connected to a North Korea linked crypto exploit can now move forward after a federal judge in Manhattan approved a key legal request. The decision allows frozen digital assets on the Arbitrum network to be transferred to an Aave controlled wallet while keeping legal claims attached to the funds.

Federal Court Clears Aave ETH Recovery Plan

U.S. District Judge Margaret Garnett modified an earlier restraining order that had frozen the assets following a major exploit involving rsETH. The ruling allows Arbitrum DAO to conduct an onchain governance vote to move the frozen ETH as part of Aave’s recovery strategy.

The judge also protected governance participants from legal consequences, stating that anyone involved in initiating, voting on, or helping complete the transfer would not violate the restraining notice.

Earlier, Arbitrum delegates had already shown strong support through an off-chain Snapshot vote. However, a final onchain vote is still required before any transfer happens.

North Korea Crypto Lawsuit and Terrorism Claims

Attorney Charles Gerstein, representing families holding around $877 million in unpaid terrorism judgments against North Korea, argued that the frozen crypto could legally be seized. The claim is based on allegations that the exploit has been linked to the Lazarus Group, a hacking organization widely associated with Pyongyang.

Legal Pressure Expands Across DeFi Platforms

The case is part of a wider legal campaign targeting North Korea-linked crypto activity across decentralized finance platforms. In a separate lawsuit, terrorism victims also accused Railgun DAO of allowing North Korean actors to move digital assets that should have remained frozen.

The complaint additionally includes Digital Currency Group, with claims tied to its earlier governance token investment in Railgun. Meanwhile, legal efforts have also extended to attempts to secure seized USDT connected to North Korean-linked activity.