A U.S. court order has disrupted a planned recovery move, putting arbitrum at the center of a legal fight over frozen hack proceeds.
Summary
Restraining notice blocks 30,766 ETH
According to a court filing, plaintiffs served a restraining notice on May 1 through Arbitrum’s governance forum. The notice blocks movement of 30,766 ETH, worth nearly $71.1 million, which the Security Council had frozen after the Kelp DAO exploit.
Moreover, the plaintiffs say the ether is property in which the DPRK holds an interest. Their claim rests on allegations that the funds were stolen by the Lazarus Group on behalf of Pyongyang, a link previously attributed by LayerZero in its breach investigation.
How the freeze began
Arbitrum’s intervention started on April 20, when the Security Council moved the assets into a controlled wallet after identifying attacker-linked addresses. In an April 21 update, the network said law enforcement had provided input on the exploiter’s identity and added that the freeze did not disrupt user activity or applications.
That said, the filing was brought by Gerstein Harrow LLP on behalf of Han Kim and Yong Seok Kim. Their case stems from the killing of Reverend Kim Dong-shik by North Korean agents, and the court awarded roughly $330 million in damages. The new filing combines that judgment with two additional cases, lifting total claims to more than $877 million before interest.
The plaintiffs also cite the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act. They argue that creditors may attach assets tied to state sponsors of terrorism, and the filing names Lazarus Group and APT-38 as instrumentalities of the DPRK.
Governance vote meets court restraint
Meanwhile, arbitrum dao freeze efforts have collided with a live governance process. On April 30, Arbitrum DAO opened a Snapshot vote on whether the frozen ETH should move to a recovery initiative formed after the exploit.
The proposal, authored by Aave Labs with contributions from Kelp DAO, LayerZero, EtherFi, and Compound, would send the funds to a multi-signature wallet run by ecosystem participants and the security firm Certora. Voting data showed overwhelming support, with a May 7 deadline set for the next stage.
Moreover, the wallet design would only receive recovered assets and use them to help restore backing for rsETH. An indemnification clause would also cover the Arbitrum Foundation, Offchain Labs, and Security Council members against claims tied to the freeze or release of funds.
However, the filing says it remains unclear how those protections apply under an active court-ordered restraint. The issue leaves the recovery plan facing a legal hurdle even as governance support remains strong.
Background to the Kelp DAO exploit
The dispute traces back to a $292 million exploit that drained 116,500 rsETH from Kelp DAO’s LayerZero-based bridge on April 18. LayerZero said a compromised RPC node setup and a 1-of-1 verifier configuration allowed a forged cross-chain message to be validated.
arbitrum news coverage around the case has also tracked the attacker’s movements on-chain. Subsequent analysis showed the funds were moved through arbitrum bridge routes and converted into Tron-based USDT, a pattern analysts said was meant to fragment the trail. Kelp DAO said the configuration matched default deployment parameters.
That said, the frozen assets now sit between two competing claims: Arbitrum’s recovery proposal and the plaintiffs’ court-backed effort to seize funds tied to North Korea-related terrorism judgments. The outcome may shape how future crypto court order disputes interact with on-chain governance.
