A federal judge in Manhattan has partially unblocked the largest pool of recoverable funds from last month's $292 million Kelp DAO exploit, but the legal cloud over those assets is not going away.
Judge Margaret Garnett of the U.S. District Court for the Southern District of New York issued a two-page order on Friday modifying a restraining notice that had locked 30,766 ETH inside Arbitrum DAO since May 1. The modification allows an onchain governance vote to send the frozen ether to a digital assets wallet controlled by Aave. The order also states that any party initiating or voting on that transaction "shall not be in violation of the Restraining Notice."
The ruling came in response to an emergency motion Aave filed earlier this week through Morrison Cohen LLP, which asked the court to vacate the restraining notice outright or, failing that, to require the plaintiffs to post a bond of at least $300 million. Judge Garnett did neither, instead landing on a middle path that lets the recovery process move forward while keeping the terrorism creditors' claims intact.
Under the order's third paragraph, Aave LLC agreed to be bound by the restraining notice as if it had been served directly, until the notice is vacated, modified, or expires. That means the funds are not free and clear once they land in Aave's wallet. If the court ultimately sides with the terrorism creditors, Aave could be compelled to surrender the ETH.
Delegate liability resolved, for now
The order directly addresses what had been one of the most pressing open questions for Arbitrum's delegate base. In prior reporting, The Block noted that it was unclear whether ARB holders who voted yes on the DeFi United proposal could be held personally liable for violating the freeze. Judge Garnett's order explicitly closes that door, at least with respect to this particular transfer.
"Any party initiating that on-chain transaction, voting with regard to that on-chain transaction, or participating in the on-chain transfer of assets to Aave LLC shall not be in violation of the Restraining Notice," the judge clarified.
Arbitrum delegates voted to approve the release of the frozen ETH on Thursday, with 182.2 million ARB tokens supporting the measure and roughly 91% of voting power in favor.
A compromise, not a victory
The order is a compromise that neither side got everything it wanted from. Aave had argued that the restraining notice should be thrown out entirely, contending that the frozen ETH was stolen from Aave users and that a thief does not gain ownership of property simply by taking it. Aave founder Stani Kulechov said as much publicly: "These funds belong to the affected users they were stolen from, full stop."
The plaintiffs, represented by Gerstein Harrow LLP, had sought to keep the funds frozen inside Arbitrum while they litigated their claim that the ETH qualifies as North Korean property. Their legal theory rests on the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, which allow judgment creditors of a state sponsor of terrorism to attach property held by the regime or its instrumentalities. The restraining notice names the Lazarus Group and APT-38 as DPRK instrumentalities, relying on LayerZero's attribution of the Kelp DAO bridge breach to the North Korean hacking collective.
The three underlying judgments, Kim v. DPRK (~$330 million), Kaplan v. DPRK (~$169 million), and Calderon-Cardona v. DPRK ($378 million), carry a combined face value exceeding $877 million before post-judgment interest.
Broader strategy
Gerstein Harrow's pursuit of Arbitrum-frozen ETH is part of a wider effort to attach North Korea-linked crypto assets wherever they surface in DeFi infrastructure. In a separate January lawsuit, the same terrorism judgment creditors sued Railgun DAO and Digital Currency Group, alleging the privacy protocol was used to launder proceeds from prior North Korean cyberattacks, including the $1.5 billion Bybit exploit. CoinDesk reported that the plaintiffs sought default against Railgun DAO in March after claiming the protocol failed to respond.
The 30,766 ETH would be the single largest contribution to DeFi United, the cross-protocol recovery effort that has raised upward of $320 million to restore rsETH's economic backing. Other major contributions include 30,000 ETH from Consensys and Joseph Lubin, a 30,000 ETH loan from Mantle, and Aave's own liquidation of the attacker's remaining rsETH positions earlier this week.
The restraining notice has followed the assets from Arbitrum to Aave, and the court has reserved decision on all remaining matters. A further hearing, where the court would actually decide who has the better claim to the frozen ETH, has not yet been scheduled.