Terrorism Creditors Seek to Seize Kelp DAO ETH Before Arbitrum Vote

A New York federal court has complicated Arbitrum DAO’s plan to compensate victims of last month’s $292 million Kelp DAO exploit. On May 1, lawyers for terrorism creditors served Arbitrum DAO with a restraining notice barring the DAO from moving 30,766 ETH (~$71.1 million) that the Arbitrum Security Council froze on April 20 after tracing the funds to addresses controlled by the Kelp DAO exploiter, according to the forum post serving the notice.

The Restraining Notice and Legal Claims

The restraining notice names Arbitrum DAO as a garnishee and treats the frozen ether as property in which North Korea has an interest, on the theory that the funds were stolen by Lazarus on Pyongyang’s behalf. LayerZero attributed the bridge breach to the North Korean state-sponsored Lazarus Group, the same collective tied to the 2022 Ronin Network and 2025 Bybit hacks.

The plaintiffs are not victims of the Kelp incident but instead hold older default judgments against the DPRK that have gone unpaid for years. The action was filed by Gerstein Harrow LLP on behalf of Han Kim and Yong Seok Kim, U.S. nationals whose family member, Reverend Kim Dong-shik, was abducted in China and killed by North Korean agents. A 2015 ruling by the U.S. District Court for the District of Columbia produced a roughly $330 million default judgment against the DPRK in that case.

The restraining notice also bundles two additional unsatisfied judgments against North Korea:

• Kaplan v. DPRK: About $169 million, predicated on alleged DPRK material support for Hezbollah rocket attacks on northern Israel during the 2006 Lebanon war
• Calderon-Cardona v. DPRK: $378 million, tied to the 1972 Lod Airport attack carried out by Japanese Red Army operatives that killed 26 people, including 17 Puerto Rican Christian pilgrims

The combined face value across all three judgments exceeds $877 million, plus more than a decade of post-judgment interest in the older cases.

The legal theory rests on the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, which together allow judgment creditors of a state sponsor of terrorism to attach property held by the regime or its agencies and instrumentalities. The notice names APT-38 and the Lazarus Group as DPRK instrumentalities.

DeFi United Proposal Sees Major Support

Arbitrum DAO opened a Snapshot temperature check on April 30 on a proposal authored by Aave Labs, with co-authors Kelp DAO, LayerZero, EtherFi, and Compound, to send the frozen ETH to DeFi United, a cross-protocol relief fund organized after the hack. Voting concludes on May 7.

The proposal would direct the funds to a 3-of-4 Gnosis Safe co-signed by Aave, Kelp DAO, EtherFi, and onchain security firm Certora, designated solely to receive recovered ETH and apply it toward restoring rsETH’s economic backing. Over 99% of votes are currently in favor of the proposal as of publication time.

The Aave proposal also includes an uncapped indemnification clause from Aave Labs covering the Arbitrum Foundation, Offchain Labs, and individual Security Council members for any claims arising out of the freeze or release. Whether that private indemnification has any force against an active restraining notice appears to be an open question.

Community Criticism and Legal Questions

Blockchain sleuth ZachXBT criticized the plaintiffs’ strategy on social media, stating: “This is a predatory US law firm with a strategy that is pure evil. Whenever there’s a new Lazarus Group victim after an exploit and crypto assets get frozen. These clowns come in say they have a claim for an alleged DPRK victim from 26 years ago that has zero relation to crypto or exploits/hacks. Seems they tried it for the Harmony, Bybit, etc […] When all they did is read my posts after I did the difficult part of gathering evidence to support the freeze.”

Yearn contributor banteg argued in a separate post that the DAO would be within its rights to ignore the order outright, since the funds have a clean provenance to Kelp and LayerZero hack victims. He urged Aave and other parties drafting recovery proposals to “skip any intermediate multisigs and move funds to the recovery contracts directly,” sidestepping potential pressure on individual signers.

Gerstein Harrow has run versions of this strategy before. The firm has argued in prior litigation that DAOs should be treated as unincorporated associations whose individual members can be held liable for the entity’s conduct, and at least one federal judge has allowed claims to proceed on that theory.

The legal posture leaves two open questions for Arbitrum’s delegate base over the next four days. The first is whether ARB holders who vote yes on the DeFi United proposal can in fact be held personally liable for any subsequent transfer. The second is precedential: in a recovery scenario where stolen crypto is traceable to both immediate exploit victims and a sanctioned state sponsor with prior unsatisfied judgments, which set of creditors has the better claim.