Share this article
North Korea terror victims escalate fight to seize $71 million from Aave hack
In a 30-page response filed Tuesday, attorneys for victims of three North Korea terrorism cases reframed the April 18 Aave hack as fraud rather than theft — a distinction that could give the attackers legal title to the borrowed crypto.
May 6, 2026, 5:09 a.m. 2 min read
What to know:
- Lawyers for victims of North Korean terrorism now argue that April’s $71 million rsETH incident on Aave was fraud rather than theft, in a bid to preserve a court order freezing the funds.
- The filing invokes the Terrorism Risk Insurance Act to claim the frozen ether as North Korean state property and questions whether Aave has standing to challenge the freeze given its own terms saying it does not control user assets.
- The dispute stems from a cross-chain bridge exploit attributed to North Korea’s Lazarus Group that drained about $230 million from Aave, even as a separate DeFi recovery fund has raised more than four times the $71 million at issue, ahead of a May 6 federal court hearing in Manhattan.
“What actually happened is that North Korea borrowed assets from users of the ‘Aave Protocol’ and did not pay it back, and when the ‘Aave Protocol’ sought to liquidate North Korea’s collateral, the ‘Aave Protocol’ unhappily discovered that the collateral was worthless,” the new filing reads.
“The law is crystal clear that a fraud victim passes title, not merely possession, to a fraudster… Charles Ponzi obtained, through his now-eponymous scheme, ‘defeasible title’ to his victims’ cash,” it continues.
