A U.S. court order has placed Arbitrum DAO’s planned use of frozen hack funds under legal restraint.
According to filings authorized by the U.S. District Court for the Southern District of New York, plaintiffs served a restraining notice on May 1 through Arbitrum’s governance forum, blocking any movement of 30,766 ETH, valued at nearly $71.1 million, that had been frozen by the Arbitrum Security Council after the Kelp DAO exploit.
Lawyers representing the plaintiffs, identified as victims holding unpaid terrorism-related judgments against North Korea, have argued that the seized ether constitutes property in which the DPRK holds an interest. Their claim rests on allegations that the funds were stolen by the Lazarus Group on behalf of Pyongyang, a link previously attributed by LayerZero in its investigation of the breach.
Arbitrum’s intervention traces back to April 20, when its Security Council moved the assets into a controlled wallet after identifying attacker-linked addresses. In an April 21 update, the network said the freeze followed input from law enforcement regarding the exploiter’s identity, adding that the action did not disrupt user activity or applications.
Gerstein Harrow LLP filed the action on behalf of Han Kim and Yong Seok Kim, whose case stems from the killing of Reverend Kim Dong-shik by North Korean agents. A U.S. court awarded roughly $330 million in damages in that case, and the latest filing combines that judgment with two others, Kaplan v. DPRK and Calderon-Cardona v. DPRK, bringing total claims to more than $877 million before interest.
Legal arguments presented by the plaintiffs cite the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, which permit creditors to attach assets tied to state sponsors of terrorism. The filing names both Lazarus Group and APT-38 as instrumentalities of the DPRK.
Governance vote collides with legal claim
Arbitrum DAO had opened a Snapshot vote on April 30 to decide whether the frozen ETH should be transferred to a recovery initiative formed after the exploit. The proposal, authored by Aave Labs with contributions from Kelp DAO, LayerZero, EtherFi, and Compound, seeks to route the funds into a multi-signature wallet managed by ecosystem participants and security firm Certora.
Voting data shows more than 99% support for the plan as of publication time, with a May 7 deadline set for the temperature check. The design limits the wallet’s function to receiving recovered assets and using them to restore backing for rsETH.
Aave Labs has included an indemnification clause in the proposal, offering to cover the Arbitrum Foundation, Offchain Labs, and Security Council members against claims tied to the freeze or release of funds. The extent to which such protections would apply under an active court-ordered restraint remains unresolved.
The dispute unfolds against the backdrop of a $292 million exploit that drained 116,500 rsETH from Kelp DAO’s LayerZero-based bridge on April 18. LayerZero’s analysis pointed to a compromise of RPC nodes and a 1-of-1 verifier setup that allowed a forged cross-chain message to pass validation, while Kelp DAO has maintained that the configuration followed default deployment parameters.
On-chain tracking cited in subsequent reports showed the attacker moving funds through Arbitrum and converting assets into Tron-based USDT, a pattern analysts said was intended to fragment the transaction trail. Estimates cited by Yahoo Finance placed North Korean-linked crypto thefts near $600 million in the first quarter, with the Kelp DAO incident accounting for a significant share.
Arbitrum’s freeze had initially been framed as a step toward recovery, but the court-backed claim has now introduced competing demands over the same pool of assets, leaving the DAO’s next move subject to legal constraint.
