What is the Kelp DAO exploit and how much was stolen?

The Kelp DAO exploit refers to a $292 million hack on April 18, believed to be carried out by a North Korean-linked group. The attackers targeted DeFi infrastructure, resulting in significant losses for users holding rsETH. A portion of the stolen funds, about 30,766 ETH worth roughly $73 million, was later frozen.

Why is a US law firm trying to block the frozen ETH transfer?

Gerstein Harrow LLP is attempting to block the transfer of the frozen Ether because its clients are owed over $877 million in damages from North Korea. The firm argues that since the hackers are linked to North Korea, the stolen crypto counts as DPRK property and can be claimed to satisfy court judgments.

What legal action has been taken against the frozen ETH?

A New York court approved a restraining notice and writs of execution preventing the Arbitrum DAO from moving the frozen Ether. If the DAO ignores this order, it could face contempt of court. This effectively locks the funds in place until the legal dispute is resolved.

How does this affect victims of the Kelp DAO hack?

Victims of the Kelp exploit may face delays in recovering their funds because of the legal dispute. If the law firm succeeds, the frozen assets could be redirected to unrelated claimants instead of returning to those directly affected by the hack.

What is Arbitrum DAO’s role in this situation?

Arbitrum DAO, through its Security Council, froze the stolen ETH shortly after the hack to prevent further movement. The DAO now controls whether the funds can be released, but its actions are constrained by the US court order.

What is Aave Labs proposing for the frozen funds?

Aave Labs proposed unfreezing the $73 million in ETH and redirecting it to a fund called “DeFi United.” This fund would aim to compensate affected rsETH holders and restore confidence in the ecosystem. However, the legal challenge complicates this plan.

Why is North Korea linked to the Kelp exploit?

The attack is believed to be carried out by TraderTraitor, a subgroup of the Lazarus Group, which is widely associated with North Korea. These groups have been linked to multiple high-profile crypto hacks and are suspected of using stolen funds to support state activities.

What are the key risks for crypto investors from this situation?

This case highlights legal uncertainty in DeFi, where courts can intervene in decentralised systems. Investors face risks not just from hacks, but also from competing legal claims over recovered funds. It also raises questions about whether “frozen” assets are truly secure.

Cryptocurrency

Image for illustrative purposes only. Not a real photo.

US law firm moves to block $73M ETH

Written by Brie CarterPublished May 4, 2026, 8:06 AM

A US law firm has filed a restraining notice to block the transfer of frozen Ether linked to the Kelp DAO exploit, arguing its clients are owed more than $877 million by North Korea.

Lawyer Charlie Gerstein of Gerstein Harrow LLP said a New York court approved the order, preventing Arbitrum DAO from moving the assets under threat of contempt.

“This is ‘property’ in which the DPRK has a stake,”

Said Gerstein, arguing the stolen Ether can be used to satisfy long-standing court judgments against North Korea.

The move could delay repayments to victims of the exploit, as the law firm’s claim competes with efforts to return funds to those directly affected.

Kelp DAO suffered a $292 million hack on April 18, attributed to TraderTraitor, a subgroup of the Lazarus Group.

Following the attack, the Arbitrum Security Council froze 30,766 ETH, valued at about $73 million, in a wallet linked to the exploit.

Separately, Aave Labs proposed redirecting the frozen funds to a recovery pool, though critics warn legal action could shift losses onto victims rather than resolving them.

At the time of reporting, Ethereum price was $2,362.75.