Back to Devoured - May 05, 2026
DEVOURED
KelpDAO Funds on Arbitrum Caught Between Recovery Vote and DPRK

KelpDAO Funds on Arbitrum Caught Between Recovery Vote and DPRK

Crypto securitypolicygovernancedao threadreaderapp.com
Frozen funds from a $292M North Korean hack of KelpDAO are contested between terrorism victims seeking to seize DPRK assets and the original hack victims, creating the first direct clash between US courts and DAO governance.
What: After Lazarus Group stole $292M from KelpDAO via a LayerZero bridge exploit, Arbitrum's Security Council froze $71M of the stolen ETH. A coalition of DeFi protocols proposed returning funds to hack victims through DAO governance, but a New York court issued a restraining order on behalf of families holding $877M in unpaid judgments against North Korea, who claim the frozen funds are seizable DPRK property.
Why it matters: This creates the first direct conflict between traditional court authority and decentralized governance, with multisig signers facing personal legal liability if they execute a passing DAO vote while a restraining order is active. The outcome will establish precedent for how on-chain organizations navigate legal pressure during future security incidents.
Takeaway: If you participate in DAO governance or serve as a multisig signer, understand that you may face personal legal liability when executing decisions involving disputed funds, even if authorized by a governance vote.
Deep dive
  • The Lazarus Group, a North Korean state-linked hacking organization, exploited a LayerZero cross-chain bridge vulnerability to steal $292 million from KelpDAO in April
  • Arbitrum's Security Council successfully froze $71 million of the stolen ETH before attackers could move it off-chain
  • Major DeFi protocols including Aave, LayerZero, EtherFi, and Compound collaborated on a governance proposal to return frozen funds to a victim compensation multisig
  • The Arbitrum DAO vote is passing with strong community support for victim restitution
  • Han Kim and other families of DPRK terrorism victims, holding $877 million in unpaid US court judgments against North Korea from attacks years ago, obtained a restraining order from a New York court
  • These creditors argue the frozen ETH constitutes seizable North Korean state property that should satisfy their decade-old judgments
  • KelpDAO victims counter that stolen funds never legally belonged to North Korea and cannot be seized to satisfy unrelated judgments
  • Multisig signers now face a dilemma: executing the DAO vote while the restraining order is active exposes them to personal legal liability
  • This case represents the first instance where competing US court claims directly conflict with DAO incident response governance
  • The resolution will set critical precedent for how decentralized organizations handle legal intervention during future security breaches
  • The case highlights fundamental tension between code-based governance and traditional legal authority in the crypto ecosystem
  • It raises complex questions about property rights for stolen assets and whether thieves can ever establish legal ownership sufficient for third-party seizure
Decoder
  • DPRK: Democratic People's Republic of Korea (North Korea), whose state-linked hacking groups have stolen billions in cryptocurrency
  • DAO: Decentralized Autonomous Organization, a blockchain-based entity governed by token holder votes rather than traditional corporate structures
  • LayerZero: A cross-chain messaging protocol that enables communication and asset transfers between different blockchains
  • Multisig: Multi-signature wallet requiring multiple parties to approve transactions, commonly used to secure DAO treasury funds
  • Lazarus Group: North Korean state-sponsored hacking organization responsible for numerous cryptocurrency thefts including this KelpDAO attack
  • Security Council: A small group with emergency powers in some DAOs to freeze funds or pause protocols in response to security threats
  • KelpDAO: A decentralized finance protocol that was the victim of the $292 million hack
  • Arbitrum: A layer-2 scaling solution for Ethereum that processes transactions more efficiently than the main Ethereum chain
Original article

Lazarus Group exploited a LayerZero bridge bug to steal $292M from KelpDAO in April, and after Arbitrum's Security Council froze $71M of the stolen ETH onchain, a New York court issued a restraining order on behalf of Han Kim and other DPRK terrorism victim families holding a combined $877M in unpaid US judgments against North Korea. Those creditors argue the frozen ETH constitutes seizable DPRK property, while the opposing position holds that North Korea never owned the funds and that KelpDAO hack victims are the rightful owners. A governance proposal backed by Aave, LayerZero, EtherFi, and Compound to release the ETH to a victim compensation multisig is passing the Arbitrum DAO vote, but multisig signers who transfer while the restraining order is active face personal legal liability. This is the first direct conflict between competing US court claims and DAO incident response governance, and the resolution will set precedent for how on-chain entities handle legal pressure during future hacks.

Explore all 52 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi