Arbitrum DAO faces court restraining notice over frozen Kelp ETH

The Arbitrum DAO has been served with a restraining notice that bars it from releasing 30,766 ETH frozen after the Kelp DAO exploit, as a U.S. court links the funds to judgments against North Korea [2]. Legal analysts argue the dispute highlights how DeFi developer‑operators may bear the brunt of emerging legal complexities in the crypto space [1].

Key takeaways

• A New York federal court authorized service of a restraining notice to Arbitrum DAO, preventing the release of roughly $71 million worth of ETH [2].
• Plaintiffs claim the frozen ETH is property tied to North Korean state‑sponsored hacking groups, invoking the Foreign Sovereign Immunities Act and Terrorism Risk Insurance Act [2].
• The notice references three default judgments against the DPRK totaling over $877 million, plus accrued interest [2].
• Analysts view the case as a warning that DeFi developers who maintain live systems could be held liable for legal outcomes beyond the original hack [1].
• The broader legal debate centers on whether stolen assets or the downstream value derived from them constitute the contested property [1].

Court Notice Targets Arbitrum‑Frozen ETH

On May 1, lawyers for victims of North Korean terrorism filed a restraining notice that names the Arbitrum DAO as a garnishee, arguing the 30,766 ETH frozen by the Arbitrum Security Council on April 20 should be treated as property in which the DPRK has an interest [2]. The notice was served through a forum post on the Arbitrum governance platform and was authorized by the U.S. District Court for the Southern District of New York [2]. Plaintiffs cite the Lazarus Group—identified by LayerZero as the actor behind the Kelp bridge breach—as an instrumental arm of the DPRK, linking the stolen funds to broader terrorism judgments dating back to 2015, 2006, and 1972 [2].

The legal theory rests on two statutes: the Foreign Sovereign Immunities Act, which permits attachment of assets held by a sovereign or its instrumentalities, and the Terrorism Risk Insurance Act, which allows judgment creditors to seize such property [2]. The combined face value of the three judgments exceeds $877 million, and the plaintiffs argue that the frozen ETH represents proceeds that ultimately belong to the DPRK, despite the hack’s immediate victims being unrelated [2].

DeFi Developer‑Operators Face Emerging Legal Risks

Blockhead’s analysis frames the dispute as part of a larger pattern where web3 teams, labeled “developer‑operators,” may be held accountable for legal outcomes that arise from their live systems [1]. The author notes that while the stolen or hacked tokens themselves quickly become worthless, the valuable property—such as the ETH obtained through the exploit—remains the focus of litigation [1]. This distinction mirrors traditional finance practices where thieves who convert stolen assets into cash must repay the value, not the exact items taken [1].