North Korea Creditors Seek to Seize Frozen Kelp DAO ETH Amid DeFi Vote

On May 1, lawyers for terrorism victims served a restraining notice on Arbitrum DAO barring the movement of 30,766 ETH (~$71.1 million) that the Arbitrum Security Council froze on April 20 following the $292 million Kelp DAO exploit. The notice names Arbitrum DAO as a garnishee and treats the frozen ether as property in which North Korea has an interest, on the theory that the funds were stolen by the Lazarus Group on Pyongyang’s behalf. LayerZero attributed the bridge breach to the North Korean state-sponsored Lazarus Group, the same collective tied to the 2022 Ronin Network and 2025 Bybit hacks.

Restraining Notice and Legal Basis

The action was filed by Gerstein Harrow LLP on behalf of Han Kim and Yong Seok Kim, U.S. nationals whose family member, Reverend Kim Dong-shik, was abducted in China and killed by North Korean agents. A 2015 ruling by the U.S. District Court for the District of Columbia, on remand from the D.C. Circuit, produced a roughly $330 million default judgment against the DPRK in that case.

The restraining notice bundles two additional unsatisfied judgments against North Korea: Kaplan v. DPRK (about $169 million, predicated on alleged DPRK material support for Hezbollah rocket attacks on northern Israel during the 2006 Lebanon war), and Calderon-Cardona v. DPRK ($378 million, tied to the 1972 Lod Airport attack carried out by Japanese Red Army operatives that killed 26 people, including 17 Puerto Rican Christian pilgrims). The combined face value across all three judgments exceeds $877 million, plus more than a decade of post-judgment interest in the older cases.

The legal theory rests on the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, which together allow judgment creditors of a state sponsor of terrorism to attach property held by the regime or its agencies and instrumentalities. The notice names APT-38 and the Lazarus Group as DPRK instrumentalities. The U.S. District Court for the Southern District of New York authorized the service of the notice.

DeFi United Vote Sees Major Support

Arbitrum DAO opened a Snapshot temperature check on April 30 on a proposal authored by Aave Labs, with co-authors Kelp DAO, LayerZero, EtherFi, and Compound, to send the frozen ETH to DeFi United, a cross-protocol relief fund organized after the hack. Voting concludes on May 7. Over 99% of votes are currently in favor of the proposal as of publication time.

The proposal would direct the funds to a 3-of-4 Gnosis Safe co-signed by Aave, Kelp DAO, EtherFi, and onchain security firm Certora, designated solely to receive recovered ETH and apply it toward restoring rsETH’s economic backing. The Aave proposal also includes an uncapped indemnification clause from Aave Labs covering the Arbitrum Foundation, Offchain Labs, and individual Security Council members for any claims arising out of the freeze or release. Whether that private indemnification has any force against an active restraining notice appears to be an open question.

Criticism and Legal Questions

Blockchain sleuth ZachXBT criticized the plaintiffs on X, writing: “This is a predatory US law firm with a strategy that is pure evil. Whenever there’s a new Lazarus Group victim after an exploit and crypto assets get frozen. These clowns come in say they have a claim for an alleged DPRK victim from 26 years ago that has zero relation to crypto or exploits/hacks. Seems they tried it for the Harmony, Bybit, etc […] When all they did is read my posts after I did the difficult part of gathering evidence to support the freeze.”

Yearn contributor banteg argued in a separate post that the DAO would be within its rights to ignore the order outright, since the funds have a clean provenance to Kelp and LayerZero hack victims. He urged Aave and other parties drafting recovery proposals to “skip any intermediate multisigs and move funds to the recovery contracts directly,” sidestepping potential pressure on individual signers.

Gerstein Harrow has run versions of this strategy before. The firm has argued in prior litigation that DAOs should be treated as unincorporated associations whose individual members can be held liable for the entity’s conduct, and at least one federal judge has allowed claims to proceed on that theory.

The legal posture leaves two open questions for Arbitrum’s delegate base over the next four days. The first is whether ARB holders who vote yes on the DeFi United proposal can in fact be held personally liable for any subsequent transfer. The second is precedential: in a recovery scenario where stolen crypto is traceable to both immediate exploit victims and a sanctioned state sponsor with prior unsatisfied judgments, which set of creditors has the better claim.