North Korea Creditors Seek to Seize Frozen Kelp DAO ETH Before Vote

On May 1, lawyers for terrorism creditors served Arbitrum DAO with a restraining notice blocking the movement of 30,766 ETH (~$71.1 million) that the Arbitrum Security Council froze on April 20 following the $292 million Kelp DAO exploit, according to The Block. The plaintiffs claim the funds were stolen by North Korean state-sponsored Lazarus Group on behalf of the Democratic People’s Republic of Korea (DPRK), and seek to attach the assets to satisfy three unsatisfied default judgments against North Korea totaling over $877 million.

Legal Action and Restraining Notice

The restraining notice was served through a forum post and authorized by the U.S. District Court for the Southern District of New York. The action was filed by law firm Gerstein Harrow LLP on behalf of Han Kim and Yong Seok Kim, U.S. nationals whose family member, Reverend Kim Dong-shik, was abducted in China and killed by North Korean agents. A 2015 ruling by the U.S. District Court for the District of Columbia produced a roughly $330 million default judgment against the DPRK in that case.

The restraining notice also encompasses two additional unsatisfied judgments: Kaplan v. DPRK (approximately $169 million, based on alleged DPRK material support for Hezbollah rocket attacks on northern Israel during the 2006 Lebanon war), and Calderon-Cardona v. DPRK ($378 million, tied to the 1972 Lod Airport attack carried out by Japanese Red Army operatives that killed 26 people, including 17 Puerto Rican Christian pilgrims). Combined face value across all three judgments exceeds $877 million, plus more than a decade of post-judgment interest in the older cases, according to the article.

The legal theory rests on the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, which allow judgment creditors of state sponsors of terrorism to attach property held by the regime or its agencies. The notice names APT-38 and the Lazarus Group as DPRK instrumentalities.

DeFi United Vote Sees Major Support

Arbitrum DAO opened a Snapshot temperature check on April 30 on a proposal authored by Aave Labs, with co-authors Kelp DAO, LayerZero, EtherFi, and Compound, to send the frozen ETH to DeFi United, a cross-protocol relief fund organized after the hack. Voting concludes on May 7, according to The Block.

The proposal would direct the funds to a 3-of-4 Gnosis Safe co-signed by Aave, Kelp DAO, EtherFi, and onchain security firm Certora, designated solely to receive recovered ETH and apply it toward restoring rsETH’s economic backing. Over 99% of votes are currently in favor of the proposal as of publication time. The Aave proposal includes an uncapped indemnification clause from Aave Labs covering the Arbitrum Foundation, Offchain Labs, and individual Security Council members for any claims arising out of the freeze or release.

Restraining Notice Draws Criticism

Blockchain sleuth ZachXBT criticized the plaintiffs on X, stating: “This is a predatory US law firm with a strategy that is pure evil.” ZachXBT argued that the law firm appears to use a pattern of claiming DPRK victim judgments unrelated to crypto exploits whenever Lazarus Group-attributed hacks result in frozen assets, citing similar attempts after the Harmony and Bybit incidents.

Yearn contributor banteg argued in a separate X post that the DAO would be within its rights to ignore the order, since the funds have a clean provenance to Kelp and LayerZero hack victims. He urged Aave and other parties drafting recovery proposals to “skip any intermediate multisigs and move funds to the recovery contracts directly,” sidestepping potential pressure on individual signers.

Gerstein Harrow has employed similar legal strategies in prior litigation, arguing that DAOs should be treated as unincorporated associations whose individual members can be held liable for the entity’s conduct. At least one federal judge has allowed claims to proceed on that theory, according to reporting on prior litigation.

Open Legal Questions

The legal posture leaves two open questions for Arbitrum’s delegate base over the next four days, as stated in the article. The first is whether ARB holders who vote yes on the DeFi United proposal can be held personally liable for any subsequent transfer. The second is precedential: in a recovery scenario where stolen crypto is traceable to both immediate exploit victims and a sanctioned state sponsor with prior unsatisfied judgments, which set of creditors has the better claim.

FAQ

What is the restraining notice and why was it issued? On May 1, terrorism creditors holding default judgments against North Korea served Arbitrum DAO with a restraining notice blocking movement of 30,766 ETH frozen after the Kelp DAO exploit. The plaintiffs claim the funds were stolen by North Korean Lazarus Group on behalf of the DPRK and seek to attach the assets to satisfy three unsatisfied judgments totaling over $877 million, according to The Block.

What is the DeFi United proposal and when will voting conclude? Arbitrum DAO opened voting on April 30 on a proposal authored by Aave Labs to send the frozen ETH to DeFi United, a cross-protocol relief fund for Kelp DAO exploit victims. The funds would go to a 3-of-4 Gnosis Safe controlled by Aave, Kelp DAO, EtherFi, and Certora. Voting concludes on May 7, with over 99% of votes currently in favor as of publication.

Who has criticized the restraining notice and why? Blockchain sleuth ZachXBT and Yearn contributor banteg have criticized the restraining notice on X. ZachXBT called it a “predatory” strategy, arguing the law firm uses unrelated decades-old DPRK victim judgments whenever Lazarus Group hacks result in frozen assets. Banteg urged the DAO to move funds directly to recovery contracts to bypass the restraining notice.