North Korea Creditors Seek to Seize Arbitrum-Frozen Kelp DAO ETH

On May 1, lawyers for terrorism victims served Arbitrum DAO with a restraining notice barring movement of 30,766 ETH (~$71.1 million) that the Arbitrum Security Council froze on April 20 after tracing the funds to addresses controlled by the Kelp DAO exploiter, according to The Block. The plaintiffs, holding unsatisfied judgments against the Democratic People’s Republic of Korea (DPRK), argue the frozen ether is property in which North Korea has an interest, claiming the funds were stolen by the Lazarus Group on Pyongyang’s behalf.

Restraining Notice and Legal Claims

The restraining notice was filed by Gerstein Harrow LLP on behalf of Han Kim and Yong Seok Kim, U.S. nationals whose family member, Reverend Kim Dong-shik, was abducted in China and killed by North Korean agents. A 2015 ruling by the U.S. District Court for the District of Columbia produced a roughly $330 million default judgment against the DPRK in that case.

The notice also bundles two additional unsatisfied judgments against North Korea: Kaplan v. DPRK (approximately $169 million, predicated on alleged DPRK material support for Hezbollah rocket attacks on northern Israel during the 2006 Lebanon war), and Calderon-Cardona v. DPRK ($378 million, tied to the 1972 Lod Airport attack carried out by Japanese Red Army operatives that killed 26 people, including 17 Puerto Rican Christian pilgrims). The combined face value across all three judgments exceeds $877 million, plus more than a decade of post-judgment interest in the older cases.

The legal theory rests on the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, which together allow judgment creditors of a state sponsor of terrorism to attach property held by the regime or its agencies and instrumentalities. The notice names APT-38 and the Lazarus Group as DPRK instrumentalities.

DeFi United Vote Progressing

Arbitrum DAO opened a Snapshot temperature check on April 30 on a proposal authored by Aave Labs, with co-authors Kelp DAO, LayerZero, EtherFi, and Compound, to send the frozen ETH to DeFi United, a cross-protocol relief fund organized after the hack. Voting concludes on May 7.

The proposal would direct the funds to a 3-of-4 Gnosis Safe co-signed by Aave, Kelp DAO, EtherFi, and onchain security firm Certora, designated solely to receive recovered ETH and apply it toward restoring rsETH’s economic backing. Over 99% of votes are currently in favor of the proposal as of publication time.

The Aave proposal also includes an uncapped indemnification clause from Aave Labs covering the Arbitrum Foundation, Offchain Labs, and individual Security Council members for any claims arising out of the freeze or release. Whether that private indemnification has any force against an active restraining notice appears to be an open question.

Community Criticism and Precedential Questions

Blockchain sleuth ZachXBT criticized the plaintiffs on X, stating: “This is a predatory US law firm with a strategy that is pure evil.” ZachXBT argued that the law firm applies this strategy whenever there is a new Lazarus Group victim after an exploit with frozen crypto assets, claiming on unsatisfied judgments from alleged DPRK victims with no relation to crypto or exploits.

Yearn contributor banteg argued in a separate post that the DAO would be within its rights to ignore the order outright, since the funds have a clean provenance to Kelp and LayerZero hack victims. He urged Aave and other parties drafting recovery proposals to “skip any intermediate multisigs and move funds to the recovery contracts directly,” sidestepping potential pressure on individual signers.

Gerstein Harrow has run versions of this strategy before. The firm has argued in prior litigation that DAOs should be treated as unincorporated associations whose individual members can be held liable for the entity’s conduct, and at least one federal judge has allowed claims to proceed on that theory.

The legal posture leaves two open questions for Arbitrum’s delegate base over the next four days. The first is whether ARB holders who vote yes on the DeFi United proposal can in fact be held personally liable for any subsequent transfer. The second is precedential: in a recovery scenario where stolen crypto is traceable to both immediate exploit victims and a sanctioned state sponsor with prior unsatisfied judgments, which set of creditors has the better claim.