New York Court Orders Arbitrum DAO to Freeze $71 Million in ETH Linked to North Korean Hackers

A New York federal court issued a restraining notice barring Arbitrum DAO from moving 30,766 ETH worth approximately $71.1 million that the Arbitrum Security Council froze on April 20 after tracing the funds to the Kelp DAO exploiter linked to North Korea's Lazarus Group. Lawyers for terrorism victims holding unpaid judgments totaling over $877 million against North Korea—including a $330 million award for the killing of Reverend Kim Dong-shik and judgments related to the 1972 Lod Airport attack and 2006 Lebanon war—served the restraining notice on May 1, seeking to attach the frozen cryptocurrency as DPRK property under terrorism exception laws. Meanwhile, Arbitrum DAO is voting until May 7 on a proposal by Aave Labs and other DeFi protocols to send the frozen ETH to DeFi United, a cross-protocol relief fund intended to restore losses from the $292 million Kelp DAO exploit, with over 99% support. The case highlights tensions between terrorism judgment enforcement and DeFi governance, with critics like ZachXBT calling the legal strategy predatory and arguing the funds have clean provenance to legitimate hack victims rather than North Korean state property.

Court Order Freezing Arbitrum DAO's Recovered Funds

• ▪Lawyers for the plaintiffs served Arbitrum DAO with the restraining notice on May 1 through a forum post.
• ▪The Kelp DAO exploit resulted in losses of $292 million in total.
• ▪The Arbitrum Security Council froze 30,766 ETH on April 20 after tracing the funds to addresses controlled by the Kelp DAO exploiter.
• ▪A New York federal court issued a restraining notice barring Arbitrum DAO from moving 30,766 ETH worth approximately $71.1 million.
• ▪The Lazarus Group was tied to the 2025 Bybit hack.
• ▪The Lazarus Group was tied to the 2022 Ronin Network hack.

Legal Claims by Terrorism Victims Against North Korea

• ▪A 2015 ruling by the U.S. District Court for the District of Columbia produced a roughly $330 million default judgment against the DPRK in the Kim Dong-shik case.
• ▪The restraining notice names APT-38 and the Lazarus Group as DPRK instrumentalities.
• ▪The combined face value across all three judgments against North Korea exceeds $877 million, plus more than a decade of post-judgment interest in the older cases.
• ▪The restraining notice bundles the Kaplan v. DPRK judgment of about $169 million, predicated on alleged DPRK material support for Hezbollah rocket attacks on northern Israel during the 2006 Lebanon war.
• ▪The 1972 Lod Airport attack was carried out by Japanese Red Army operatives.
• ▪The restraining notice bundles the Calderon-Cardona v. DPRK judgment of $378 million, tied to the 1972 Lod Airport attack that killed 26 people including 17 Puerto Rican Christian pilgrims.

DAO Governance Vote and Community Response to the Restraining Notice

• ▪Voting on the Arbitrum DAO proposal to send frozen ETH to DeFi United concludes on May 7.
• ▪Over 99% of votes on the Arbitrum DAO proposal are in favor as of publication time.
• ▪Arbitrum DAO opened a Snapshot temperature check on April 30 on a proposal to send the frozen ETH to DeFi United.
• ▪The Arbitrum DAO proposal would direct the frozen funds to a 3-of-4 Gnosis Safe co-signed by Aave, Kelp DAO, EtherFi, and Certora.
• ▪ZachXBT stated that Gerstein Harrow comes in after Lazarus Group exploits claiming they have a claim for an alleged DPRK victim from 26 years ago with zero relation to crypto or exploits.

Perspective of Terrorism judgment creditors (Gerstein Harrow LLP clients)

• ▪APT-38 and the Lazarus Group function as instrumentalities of the DPRK regime for purposes of asset attachment.

Perspective of DeFi protocols and hack victims (Kelp DAO, LayerZero, Aave Labs)

• ▪The 30,766 ETH frozen on Arbitrum has clean provenance traceable to Kelp DAO and LayerZero hack victims rather than North Korean state property.

2 sources