North Korea's Lazarus Group Faces Federal Court Battle Over $71 Million in Seized Funds

May 10, 2026

Two claimant groups faced off in Manhattan federal court on May 6, 2026, over $71 million in seized funds linked to North Korea's Lazarus Group. The funds stem from the April 18, 2026 KelpDAO hack, where attackers minted 116,500 rsETH tokens without collateral and borrowed approximately $190 million of Ether on Aave. The court must decide whether the thief was North Korea and whether North Korea can claim ownership of stolen assets.

KelpDAO exploit mechanics

▪The KelpDAO attacker posted fake rsETH receipts as collateral on Aave and borrowed approximately $190 million of real Ether.
▪The KelpDAO attacker found a weakness in the process for moving assets across blockchains and used it to mint 116,500 rsETH tokens without depositing collateral.

Lazarus-North Korea attribution debate

▪The Office of Foreign Assets Control rated the reliability of Lazarus Group aliases including 'OFFICE 91,' 'HIDDEN COBRA,' and 'GUARDIANS OF PEACE' as 'weak.'
▪The 179-page FBI indictment said Park Jin Hyok was a government-employed programmer tied to a hacking organization under North Korea's Reconnaissance General Bureau.
▪The Lazarus Group has been linked to the 2014 hack of Sony Pictures.
▪The Lazarus Group has been linked to the 2016 theft of $81 million from Bangladesh Bank.
▪The Office of Foreign Assets Control has placed the Lazarus Group on its North Korea-related sanctions list and lists the Lazarus Group's address as Botonggang District, Pyongyang.
▪The Justice Department in September 2018 indicted North Korean programmer Park Jin Hyok as a member of the Lazarus Group.
▪The Lazarus Group has been linked to the 2017 WannaCry ransomware attack that crippled computers around the world.

Federal court asset dispute

▪$71 million of Ether stolen in the KelpDAO hack was frozen and was supposed to be used to compensate rsETH holders who had lost assets.
▪On the evening of May 1, 2026, a US law firm obtained a prejudgment attachment over the frozen $71 million just before the funds were to be returned to KelpDAO victims.
▪On May 6, 2026, two sets of claimants tied to North Korea-related losses faced off in federal court in Manhattan over rights to $71 million in seized funds.
▪The article about the KelpDAO hack and federal court dispute was published on May 10, 2026.

DeFi contagion aftermath

▪Aave's AAVE token fell nearly 20% following the KelpDAO attack.
▪Aave founder Stani Kulechov led an effort with other DeFi firms to create a fund worth approximately $320 million in response to the KelpDAO exploit.
▪Nearly $6 billion was withdrawn from Aave within days after the KelpDAO exploit became known.

Victim judgment enforcement

▪Pastor Kim Dong-sik's brother and son won a judgment in federal court in Washington in 2015 against North Korea for $30 million in compensatory damages and $300 million in punitive damages.
▪Families of victims in North Korea-related cases have been awarded more than $877 million in unpaid judgments by US courts that North Korea has never satisfied.
▪Pastor Kim Dong-sik was reported to have been abducted by North Korean agents in China in 2000 while helping North Koreans defect.
▪Pastor Kim Dong-sik's family has spent 11 years searching for North Korean assets that could be used to enforce their $330 million judgment.

Perspective of Families of North Korea-related victims

▪Families of victims in North Korea-related cases have been awarded more than $877 million in unpaid judgments by US courts that North Korea has never satisfied.