North Korea creditors seek Arbitrum-frozen 30,766 ETH

On May 1, lawyers for judgment creditors served Arbitrum DAO with a restraining notice seeking control of 30,766 ETH, about $71.1 million, that Arbitrum's Security Council froze on April 20 after tracing the funds to addresses tied to the Kelp DAO exploit. The U.S. District Court for the Southern District of New York authorized service of the notice, which was posted to the DAO's forum. LayerZero has attributed the original bridge breach to the Lazarus Group.

The action was filed by Gerstein Harrow LLP on behalf of U.S. nationals Han Kim and Yong Seok Kim. Their family member, Reverend Kim Dong-shik, was abducted in China and killed by North Korean agents. The plaintiffs hold a roughly $330 million default judgment from a 2015 ruling. The notice also attaches two additional unsatisfied judgments: Kaplan v. DPRK at about $169 million and Calderon-Cardona v. DPRK at $378 million. Combined face value across the three judgments exceeds $877 million, not including post-judgment interest on older awards.

The restraining notice treats the frozen ether as property in which North Korea has an interest and identifies APT-38 and the Lazarus Group as DPRK instrumentalities. The plaintiffs rely on the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, which allow judgment creditors of designated state sponsors of terrorism to seek attachment of property held by the state or its agencies. The plaintiffs are not victims of the Kelp incident.

Arbitrum DAO was conducting a Snapshot temperature check on a recovery proposal when the restraining notice arrived. The April 30 proposal, authored by Aave Labs with co-authors Kelp DAO, LayerZero, EtherFi and Compound, would send the frozen ETH to DeFi United, a cross-protocol relief fund formed after the hack. Voting closes May 7, and more than 99% of votes recorded so far are in favor.

Under the proposal, the funds would go to a 3-of-4 Gnosis Safe co-signed by Aave, Kelp DAO, EtherFi and security firm Certora, and be used to restore the economic backing of rsETH. The proposal includes an uncapped indemnification from Aave Labs covering the Arbitrum Foundation, Offchain Labs and individual Security Council members for any claims arising from the freeze or release.

Legal observers say it is unclear whether a private indemnity would override a court-authorized restraining notice. Critics in the crypto community called the plaintiffs' legal strategy predatory. Blockchain analyst ZachXBT posted that the plaintiffs relied on evidence gathered by others. A Yearn contributor, banteg, posted that the DAO could ignore the order and move funds directly to recovery contracts to avoid pressure on multisig signers.

Gerstein Harrow has pursued related strategies before, arguing that decentralized autonomous organizations can be treated as unincorporated associations whose individual members may be liable. At least one federal judge has allowed claims against DAO participants to proceed on similar theories.

The restraining notice, the pending DAO vote and the competing judgments raise two open legal questions: whether ARB token holders who approve a transfer could face personal liability, and which set of creditors — immediate exploit victims or judgment creditors with unsatisfied awards against a sanctioned state — would have priority to the frozen funds. The vote concludes May 7.