Arbitrum's governance passed a 90% supermajority vote to release 30,765 ETH to innocent DeFi victims. Then a Manhattan federal court handed the funds to North Korea terrorism creditors instead. What happens when code-is-law walks into a courthouse and gets asked to show some ID.
There is a moment in every major DeFi exploit when the story stops being about code and starts being about people. That moment arrived for Arbitrum on the morning of 8 May 2026, when a DAO vote closed with 90% approval to release $71 million in frozen ether, and a federal court in Manhattan had already quietly decided it had something to say about that. This is, simultaneously, a story about North Korean state-sponsored theft, the structural limits of decentralised governance, an American family pursuing a decade-old $300 million judgment against Pyongyang, and innocent DeFi users who lost money through no fault of their own. Every party has a coherent argument. Most of them will be disappointed.
On 18 April 2026, Lazarus Group exploited the LayerZero bridge infrastructure underlying KelpDAO's rsETH token, minting 116,500 unbacked rsETH tokens, borrowing $230M in legitimate ETH against them, and leaving DeFi protocols holding worthless collateral. Total ecosystem drain: approximately $292 million. Two days later, Arbitrum's Security Council acted with a 9-of-12 supermajority: they executed an emergency transfer of 30,766 ETH, approximately $71 million, out of the attacker's Arbitrum One address into a governance-controlled wallet, pending DAO vote on distribution.
"If a small group can step in to stop a hacker, the same mechanism could, in theory, be used in other situations, whether under regulatory pressure or political influence. The concern is less about this specific case and more about the precedent it sets for what decentralised governance actually means." Commentary following the Security Council freeze, April 2026
Aave, KelpDAO, LayerZero, EtherFi, and Compound assembled a coordinated recovery effort branded "DeFi United." The plan: release the frozen 30,766 ETH into a Gnosis Safe multisig, combine it with additional pledges from Mantle, Lido, Consensys, and Aave's treasury, and use the pooled funds to restore rsETH's economic backing and compensate users who lost money. The DAO voted. Result: 90% supermajority in favour of release, among the highest participation rates in Arbitrum's governance history.
Han Kim and Yong Seok Kim are US nationals whose relative was killed in a North Korean attack. A US federal court awarded them over $300 million in damages against the DPRK in 2015. That judgment has never been paid. Attorney Charles Gerstein of Gerstein Harrow LLP identified a legal theory: if the Lazarus Group stole the KelpDAO ETH, and if Lazarus operates under direct DPRK authority, then those frozen funds are North Korean property, and North Korean property within reach of a US court can be seized to satisfy an unpaid judgment. On 1 May 2026, Gerstein served a restraining notice on Arbitrum DAO through its governance forum. The Southern District of New York issued an order barring any transfer of the frozen ETH.
When the Constitutional AIP vote closed on 8 May 2026, over 90% of participating ARB token holders had voted to release the ETH to the DeFi United recovery fund. Under Arbitrum's own governance rules, a Constitutional AIP cannot be executed for at least eight days after passing, a delay built specifically to allow courts time to intervene. That delay, written into the DAO's own constitution, is the mechanism the Manhattan court is now using to hold the funds in place.
"Code is law works perfectly until a federal court disagrees. Then code is law until the marshal shows up. This case is deciding which comes first."
Praveen Giri, Founder · QuantChainAnalysis| Party | Argument | Legal Basis | Outcome Risk |
|---|---|---|---|
| DeFi United (innocent users) | Funds belong to DeFi victims; DAO voted to restore them | Arbitrum governance constitution; natural justice | Legally strongest on merits; blocked by SDNY order |
| Terror creditors (Kim family) | Lazarus funds = DPRK property; satisfies $300M judgment | 18 U.S.C. § 2333; NY asset seizure statutes; SDNY restraining order | Strong procedural position; enforcement execution uncertain |
| Arbitrum DAO | Governance vote should control; no jurisdiction over on-chain assets | Arbitrum Constitution; decentralisation principles | Constitutional argument unlikely to prevail in federal court |
The KelpDAO exploit, the theft that created the 30,766 ETH now frozen in Arbitrum governance, had one technical intervention point: the forged minting transaction in the mempool, approximately 19 seconds before it settled. Had that transaction been refused at the pre-mempool gate, none of the downstream consequences exist: no $292M theft, no Arbitrum freeze, no SDNY restraining order, no conflict between DeFi governance and federal court authority, and no family still waiting to collect on a decade-old judgment against North Korea.