Laywer pops up on Arbitrum DAO forums seeking funds for victims of decades-old North Korean terrorist acts
Families holding decades-old judgments against North Korea are trying to seize 30,765 ETH frozen after last month’s rsETH exploit, citing alleged links between the attack and DPRK-linked hacking groups such as Lazarus, and invoking a New York restraining notice that could block Arbitrum from releasing the funds.
By Sam Reynolds|Edited by Shaurya Malwa May 4, 2026, 11:53 a.m. 3 min readMake preferred on
What to know:
- A lawyer representing victims of North Korean terrorism has served Arbitrum DAO with a New York restraining notice, seeking to block the release of 30,765 ETH frozen after the rsETH exploit by claiming it is DPRK-linked property.
- The filing names Arbitrum DAO as a garnishee in three federal enforcement actions tied to long-standing judgments totaling about $877 million against North Korea, warning that moving the funds could expose those controlling the assets to contempt of court.
- Some Arbitrum delegates argue the ETH is stolen property that should be returned to rsETH depositors, framing the dispute as a choice between compensating recent DeFi victims and satisfying decades-old terrorism-related judgments against Pyongyang.
Arbitrum delegates are in the process of weighing whether to release 30,765 ETH frozen after last month's rsETH exploit into a coordinated recovery effort. But a lawyer for victims of North Korean terrorism showed up in the forum and told them they couldn’t.
The ether was drained from restaked ETH holders (a representative token of ETH that is locked on another platform for fixed yields) during the April 19 Kelp DAO bridge exploit, which CoinDesk previously reported as the largest DeFi hack of 2026.
The governance post, authored by attorney Charles Gerstein, serves as a restraining notice under New York law on behalf of three sets of judgment creditors holding roughly $877 million in claims against the Democratic People's Republic of Korea.
The claims behind the filing stretch back decades. One stems from the 1972 Lod Airport massacre in Israel, where gunmen killed 26 people, including 17 Puerto Rican pilgrims, in an attack later found by a U.S. court to have been supported by North Korea.
Another involves Reverend Kim Dong Shik, a U.S. permanent resident abducted near the China border in 2000 and later killed in DPRK custody. A third ties to the 2006 Israel-Hezbollah war, where a federal judge found Pyongyang had supplied weapons and training used in rocket attacks.
The plaintiffs won their cases but North Korea has never paid. With sovereign assets effectively impossible to seize, the families have spent years searching for any North Korean property they can legally collect against to satisfy their judgments.
Gerstein's filing argues that because U.S. authorities have linked the Lazarus Group, the hacking unit responsible for the exploit, to the North Korean state, the 30,765 ETH frozen by Arbitrum's Security Council qualifies as North Korean property under U.S. enforcement law.
If the court accepts that framing, the families with unpaid judgments would have a senior legal claim on those funds, ahead of the rsETH depositors who originally held them.
The reason Arbitrum is involved is straightforward: after the rsETH exploit, its Security Council froze 30,765 ETH at a specific address on its network, effectively placing the funds under its control. Gerstein’s filing points to three underlying cases, Calderon-Cardona, Kim, and Kaplan, with writs of execution totaling roughly $877 Million.
The legal tool being used is CPLR §5222(b), a New York enforcement mechanism that allows creditors to freeze assets simply by serving a restraining notice, without first getting a new court order, though the target can challenge it afterward.
Once served, the recipient is barred from moving the assets for up to a year or until the judgment is resolved. Ignoring it can lead to contempt of court, the same category of offense used when someone defies a judge’s order.
The complication here is that Arbitrum DAO is not a company with clear legal status. That means the risk doesn’t neatly attach to “the DAO,” but to whoever a court ultimately decides has control over the frozen ETH.
The filing and legal theory presented drew pushback inside the same forum thread. Delegate Zeptimus argued the legal premise is backwards, writing that the ETH "is not property in which the DPRK has an 'interest'… It's stolen property," and adding that under basic property law "a thief acquires no title."
In that view, the funds belong to the original rsETH depositors, and the proposed recovery effort is not a redistribution but a return of assets to their rightful owners. Blocking that process, Zeptimus wrote, "shifts the cost of the DPRK's debt onto a different set of victims who were themselves robbed."
Delegates had been working through a different set of trade-offs. Entropy Advisors urged a FOR vote, citing the daily interest cost to Aave users with stuck positions. Axia flagged questions about whether the Arbitrum Captive Insurance Product would cover delegates if something went wrong.
Gerstein’s filing sharpens that question considerably, where coverage for ordinary delegate liability is one thing but exposure tied to a live enforcement action is another.
What’s left is a choice between victims. On one side, Aave depositors with positions they can’t close. On the other, families behind decades-old judgments against North Korea, still seeking to collect.
hackingMore For You
Iran missile report sends bitcoin back to $79,000, with ETH, SOL, DOGE sharply lower
By Shaurya Malwa31 minutes ago
The largest crypto reversed sharply from a $80,594 high after Iran's Fars news agency claimed two missiles hit a U.S. warship, with oil spiking 5% before the U.S. denied the report.
What to know:
- Bitcoin briefly topped $80,000 for the first time since January before sliding to about $79,000 after reports of a suspected Iranian missile strike on a U.S. patrol boat near Jask Island.
- The U.S. denied that any of its ships were hit, prompting oil and equity futures to pare sharp initial...
Bitcoin stalls near $80,000. Stocks and ETF inflows still point to a breakout.
27 minutes ago
Iran missile report sends bitcoin back to $79,000, with ETH, SOL, DOGE sharply lower
31 minutes ago
Coinbase boosts Solana trading with DFlow integration
1 hour ago
Crypto bears got it wrong again, losing $300 million in liquidations
1 hour ago
Jobs data, earnings calls: Crypto Week Ahead
4 hours ago
Recovery in bitcoin ETF inflows is real. It is just not complete yet.
4 hours agoTop Stories
U.S. voters don't trust Trump administration to oversee crypto sector, CoinDesk poll finds
22 hours ago
Veteran trader Peter Brandt sees bitcoin hitting $250,000, but only after a bottom later this year
7 hours ago
Strategy pauses bitcoin buys before Tuesday earnings
6 hours ago
Crypto industry backs CLARITY Act yield compromise, pushes Senate Banking for markup
May 2, 2026
Clarity Act text lets crypto firms offer stablecoin rewards while shielding bank yield
May 1, 2026
