North Korea Terrorism Creditors Seek $71M in Frozen Arbitrum ETH, Clouding Kelp DAO Recovery Vote
A U.S. federal court has ordered Arbitrum DAO to halt any transfer of 30,766 ETH frozen after the April Kelp DAO exploit, after terrorism judgment creditors filed to claim the funds before a DeFi recovery coalition can access them.
On May 1, 2026, the U.S. District Court for the Southern District of New York issued a restraining order blocking the Arbitrum DAO from moving approximately $71 million in frozen ETH. The plaintiffs are not victims of the Kelp DAO hack. They are creditors holding decade-old terrorism judgments against North Korea, and they are using the Foreign Sovereign Immunities Act (FSIA), a federal law that allows seizure of assets traceable to a terrorism judgment debtor, to pursue the frozen funds. Because North Korea holds almost no conventional U.S.-attachable assets, blockchain-traced funds represent one of the only viable recovery paths available to these creditors.
The same day the court issued its order, Arbitrum DAO launched a governance temperature check vote on a proposal to release those exact funds to the DeFi United recovery coalition. Within the first hour, 16.9 million ARB tokens voted in favor with no opposition. The vote runs until May 7. The court order has now thrown its outcome into legal uncertainty.
How the Funds Were Frozen
Kelp DAO, a liquid restaking protocol built on EigenLayer that allows users to deposit stETH or cbETH and receive rsETH tokens usable across DeFi platforms, was exploited on April 18 for approximately $292 million.
Attackers forged cross-chain messages through Kelp's LayerZero V2 bridge, minting unbacked rsETH tokens without burning corresponding deposits on Unichain. The intrusion exploited an off-chain RPC node compromise rather than a smart contract bug, a harder-to-audit surface with direct relevance for developers running LayerZero-compatible bridge infrastructure. The attackers deposited the rsETH as collateral across Aave V3, Compound, and Euler, then borrowed roughly $236 million in WETH and other assets. The hack is the largest DeFi exploit of 2026, narrowly surpassing the $285 million Drift Protocol attack from April 1.
On April 20, the Arbitrum Security Council used emergency powers requiring a 9-of-12 supermajority to freeze 30,766 ETH that the attacker had moved to an Arbitrum One address. The funds now sit in governance-controlled wallet 0x0000000000000000000000000000000000000DA0. Multiple blockchain forensics firms, including TRM Labs and Chainalysis, have attributed the attack to North Korea's Lazarus Group, operating under the TraderTraitor banner. Approximately $175 million of the stolen funds were subsequently converted to Bitcoin via THORChain, consistent with the laundering tradecraft associated with North Korean state-backed operations. TRM Labs data shows North Korean actors stole $577 million in crypto in 2026 through this period, representing 76 percent of all global crypto hack losses year-to-date.
Who Is Claiming the Money
Three groups of plaintiffs filed to intercept the frozen ETH before any DAO transfer can occur. Han Kim and Yong Seok Kim, relatives of a South Korean pastor abducted from China and killed by North Korea, hold a 2015 judgment awarding $15 million each in compensatory damages plus $300 million in punitive damages.
Two additional plaintiff groups hold judgments totaling $547 million across the Kaplan v. Hezbollah and Calderon-Cardona v. DPRK cases. Kaplan v. Hezbollah is a judgment against Hezbollah rather than directly against North Korea; court filings reviewed for this article do not fully specify the legal theory under which Hezbollah judgment creditors claim standing to pursue assets traced to a North Korean hack under FSIA.
All three plaintiff groups are represented by Gerstein Harrow LLP, a boutique litigation firm with a track record of targeting crypto entities using legacy judgments.
On-chain investigator ZachXBT called Gerstein Harrow "a predatory US law firm with a strategy that is pure evil," and noted the firm appeared to rely on his own published blockchain analysis from prior cases rather than conducting independent tracing work. In a striking development reported by COINOTAG, wallets linked to the attacker voted in favor of the DeFi United recovery proposal during the governance temperature check.
Attorney Gabriel Shapiro summarized the immediate effect plainly: "Arbitrum DAO is not allowed to do anything with the KelpDAO funds for now, until a divestiture hearing."
The court's order goes further than a simple freeze. It explicitly warns that Arbitrum Security Council members, DAO voters, and individual ARB token holders could face personal legal liability if funds are moved before a final ruling. The court approved a service plan requiring notification through four distinct channels: posting on Arbitrum's governance forum, direct mail to legal entities behind the DAO, individual mail to Security Council members, and mail to major ARB token holders.
The Recovery Effort at Stake
DeFi United, the industry coalition formed after the exploit, has pledged over $311 million toward restoring rsETH's full backing. Contributors include Consensys co-founder Joseph Lubin (30,000 ETH), Mantle (30,000 ETH via credit facility), Aave DAO (25,000 ETH pending a separate vote), LayerZero (10,000 ETH), and Kelp DAO itself (2,000 ETH toward its own recovery fund).
The Arbitrum governance proposal, formally designated a Constitutional AIP and co-authored by Aave Labs, Kelp DAO, LayerZero, EtherFi, and Compound, would transfer 30,765.66 ETH to a 2-of-3 Gnosis Safe controlled by Aave, Kelp DAO, and security firm Certora. That figure reflects the precise amount specified in the proposal; the 30,766 ETH figure used earlier in this article reflects the rounded amount recorded at the time of the Security Council freeze.
Aave Labs has included an indemnification clause covering the Arbitrum Foundation, Offchain Labs, and Security Council members against any resulting claims, with no monetary cap, basket, or deductible, under New York law. Unchained Crypto has described the clause as unusually broad.
rsETH was trading at $2,391.65 as of May 3, up 12.10% over the prior seven days.
Why This Matters Outside the United States
The restraining order has direct consequences for DeFi users well beyond U.S. borders. The exploit contributed to a $13.21 billion drop in total DeFi TVL within 48 hours, including $8.45 billion in Aave deposit outflows.
Users in markets like India, Nigeria, Kenya, and South Africa, where liquid staking yields serve as dollar-denominated savings alternatives, are exposed to prolonged uncertainty over rsETH's backing without any legal standing in the New York court proceeding.
The broader precedent is more alarming for global builders. The case establishes that a DAO governance action, specifically the Security Council freeze, can bring protocol assets within U.S. court jurisdiction. Because the attack exploited an off-chain RPC node compromise rather than a smart contract vulnerability, developers in emerging markets running LayerZero-compatible bridge infrastructure face a threat surface that is harder to audit and harder to insure against. Developers building on Arbitrum or integrating rsETH as collateral in local protocols, regardless of where they operate, now face a credible scenario in which U.S. creditors claim governance-controlled funds before hack victims receive any recovery.
If the court allows creditors holding terrorism judgments, at least one dating to 2015, to claim funds ahead of the actual 2026 hack victims, it will also set a chilling precedent for cross-border industry mutual aid.
A divestiture hearing is expected before any transfer could occur, with execution of the DAO proposal targeted for early to mid-June 2026 if the legal challenge is resolved in the DAO's favor.