Arbitrum

Charlie

ZachXBT

April

Security

A US law firm has filed a restraining notice to block the transfer of frozen Ether from the Kelp exploit, arguing that its clients are owed over $877 million in compensation and damages by North Korea.&nbsp;
Charlie Gerstein, a lawyer for US law firm Gerstein Harrow LLP, <a href="https://forum.arbitrum.foundation/t/constitutional-aip-approve-release-of-frozen-eth/30825/24" rel="noopener noreferrer nofollow">said</a> in a post on the Arbitrum DAO forum on Friday that a New York district court <a href="https://gersteinharrow-my.sharepoint.com/personal/jason_gerstein-harrow_com1/_layouts/15/onedrive.aspx?ga=1&amp;id=%2Fpersonal%2Fjason%5Fgerstein%2Dharrow%5Fcom1%2FDocuments%2FClio%2FService%20in%20Arbitrum%2FRestraining%20Notice%2Epdf&amp;parent=%2Fpersonal%2Fjason%5Fgerstein%2Dharrow%5Fcom1%2FDocuments%2FClio%2FService%20in%20Arbitrum" rel="noopener noreferrer nofollow">signed</a> off on a restraining notice and three writs of execution preventing the DAO from moving the Ether under threat of contempt of court.
The law firm argued that its clients, who were not affected by the Kelp exploit, won default judgments against North Korea in three separate US court cases in 2010, 2015 and 2016 and are owed a collective $877 million in compensatory and punitive damages, plus interest.
It also argued that its clients have a claim to DPRK property. Gerstein said in the restraining notice that the stolen Ether is “property” in which the DPRK has a stake because the hacker group is affiliated with the country.
The freeze could mean those affected by the Kelp exploit would need to wait longer to see their funds recovered.&nbsp;This isn’t the first time the firm has attempted to claim stolen cryptocurrency.
Kelp DAO suffered a $292 million hack on April 18, which is believed to have been carried out by <a href="https://cointelegraph.com/features/north-korean-hackers-578m-april-kelp-dao-exploit" rel="noopener noreferrer nofollow">TraderTraitor</a>, a subgroup of North Korea’s state-backed hacking unit, Lazarus Group.&nbsp;
Days later, Arbitrum Security Council <a href="https://cointelegraph.com/news/arbitrum-freezes-71m-ether-connected-kelp-exploit" rel="noopener noreferrer nofollow">took emergency action to freeze</a> 30,766 Ether (ETH), worth over $73 million, held in a wallet linked to the Kelp exploit.
<img alt="US law firm attempts to block transfer of frozen ETH from Kelp exploit" height="607" src="https://payload.lum-tri.org/api/media/file/pasted-image-258.png?prefix=media%2Fcontent" width="895">
Charlie Gerstein, a lawyer for Gerstein Harrow, posted a restraining notice seeking to prevent the Arbitrum DAO from moving the frozen Ether. Source: <a href="https://forum.arbitrum.foundation/t/constitutional-aip-approve-release-of-frozen-eth/30825/21" rel="noopener noreferrer nofollow">Arbitrum DAO</a>
<h2 id="funds-were-proposed-for-kelp-victims">Funds were proposed for Kelp victims</h2>
Aave Labs proposed on April 25 that the Arbitrum DAO <a href="https://cointelegraph.com/news/arbitrum-dao-asked-to-unfreeze-30k-eth-tied-to-kelp-hacker-direct-them-to-defi-united" rel="noopener noreferrer nofollow">unfreeze the $73 million in Ether</a> tied to the Kelp DAO attack and direct those funds to “DeFi United,” a fund aimed at restoring rsETH and compensating its holders.
An Arbitrum DAO member under the handle Zeptimus <a href="https://forum.arbitrum.foundation/t/constitutional-aip-approve-release-of-frozen-eth/30825/24" rel="noopener noreferrer nofollow">said</a> that if the law firm’s action is successful, the DPRK debt will not be transferred to the Kelp DAO victims.
“Your clients’ losses are real and the DPRK should answer for them. But the remedy the restraining notice asks for, blocking the return of stolen funds to their actual owners shifts the cost of the DPRK’s debt onto a different set of victims who were themselves robbed. That compounds the original harm; it doesn’t redress it,” they said.
<h2 id="gerstein-harrow-filed-similar-claims-before">Gerstein Harrow filed similar claims before</h2>
Gerstein Harrow has filed similar cases in the past, arguing its clients have a claim to funds stolen by the DPRK and frozen by crypto firms. In February, the firm <a href="https://gerstein-harrow.com/Cases/Doc.%208%20Han%20Kim%20Claim%20.pdf" rel="noopener noreferrer nofollow">filed</a> a claim against funds frozen by Tether that were <a href="https://hacken.io/insights/heco-bridge-hack-explained/" rel="noopener noreferrer nofollow">stolen</a> in the 2023 Heco Bridge hack.
Related: <a href="https://cointelegraph.com/news/north-korean-hackers-use-ai-enabled-social-engineering-latest-attack" rel="noopener noreferrer nofollow">North Korean hackers used AI-enabled social engineering in Zerion attack</a>
It has also filed class-action suits <a href="https://gerstein-harrow.com/cases.html" rel="noopener noreferrer nofollow">against</a> multiple DAOs. At the same time, onchain sleuth ZachXBT <a href="https://x.com/zachxbt/status/2050416231807906040" rel="noopener noreferrer nofollow">accused</a> the law firm of using his research in court documents to <a href="https://gerstein-harrow.com/Cases/Doc.%204%20Circle%20Turnover%20Memo%20of%20Law.pdf" rel="noopener noreferrer nofollow">stake</a> a claim on funds from the $1.5 billion Bybit hack.
<img alt="US law firm attempts to block transfer of frozen ETH from Kelp exploit" height="547" src="https://payload.lum-tri.org/api/media/file/pasted-image-259.png?prefix=media%2Fcontent" width="1197">
The law firm has three live cases against DAOs on its website. Source: <a href="https://gerstein-harrow.com/cases.html" rel="noopener noreferrer nofollow">Gerstein Harrow</a>
North Korea-affiliated actors have been accused of stealing at least $578 million across major incidents throughout April and have been linked to many of the industry’s largest hacks, including the Bybit exploit.
Magazine: <a href="https://cointelegraph-magazine.com/defis-billion-dollar-secret-the-insiders-responsible-for-hacks/" rel="noopener noreferrer nofollow">DeFi’s billion-dollar secret: The insiders responsible for hacks</a>&nbsp;

US law firm attempts to block transfer of frozen ETH from Kelp exploit

Table of Contents

Cointelegraph

Other articles published on May 4, 2026

Join our free newsletter for daily crypto updates!