Creditors linked to North Korea are targeting the Kelp DAO fund

Recovery after hacking and legal confiscation

The frozen money originated from the Kelp DAO network attack in April, where hackers withdrew nearly $300 million in assets. Part of that money was then traced by Arbitrum's Security Council and frozen by emergency rights.

Creditors whose rulings of the US court are trying to seize about 30,766 ETH (worth about 71 million dollars) frozen by the Arbitrum Security Council after the large-scale Kelp DAO cyber attack in April 2026. This move creates a complicated legal battle between the victims of the recent DeFi hack and the families who have been compensated for damages by North Korea's terrorist actions many years ago.

Lawyers representing the plaintiffs with nearly $877 million in unpaid judgments against the DPRK have sent a ban notice to Arbitrum DAO, preventing the release of frozen money. This ETH is traced to wallets associated with the Lazarus Group (TraderTraitor subgroup), which is believed to be the culprit of the Kelp DAO bridge mining case worth about $290–292 million.

Creditors seek to enforce the $877 million ruling

The plaintiffs are not victims of the Kelp DAO attack. Instead, they are long-time creditors holding more than $877 million in unpaid compensation from US court rulings against North Korea, related to terrorism cases. Their legal argument is that because the attack is related to the Lazarus Group, frozen cryptocurrency assets can be considered state-linked assets and confiscated in response to those rulings.

This creates a precedent situation in which on-chain funds become the subject of off-chain geopolitical claims. This lawsuit creates a direct conflict between decentralized governance and traditional legal systems.

On the one hand, Arbitrum's DAO is about to vote on redistributing money to users affected by the attack. On the other hand, a US court has now intervened, freezing administrative decisions until the legal process is resolved.

The consequences are very significant. If the court ruling is upheld, it shows that assets controlled by DAO can be legally confiscated, governance decisions can be rejected, and participants (including voters) may face legal risks. This challenges one of the core assumptions of DeFi that full control is decided by source code and consensus.

The identification of the culprit becomes a key financial factor

The focus of the case is to identify the culprit. Blockchain analysis has linked the attack to the Lazarus Group, a state-backed hacker organization long-standing links to North Korea. This identification of the culprit allows creditors to claim that the property is related to a sanctioned entity.

In fact, identifying the attacker is no longer just a security issue, but becomes a key factor in determining who has the legal right to that money. This case can create an important precedent on how to handle cryptocurrency assets in the legal system.

If creditors succeed, it can establish that frozen DeFi funds can be diverted by the court, the sanction law applies directly to on-chain assets, and recovery attempts can be disabled by external requests. Broadly speaking, this signals that DeFi does not operate in isolation. It exists in a legal environment where state entities, courts and international law can intersect with blockchain systems.

Evaluation and conclusion

Legal proceedings are expected to continue in U.S. courts, with the parties involved in Arbitrum DAO and Kelp DAO closely monitoring the developments. A solution that could create important precedents on how to finally distribute frozen crypto assets in connection with North Korea's cyberattack activities. This situation reminds of the complex intersection between cryptocurrencies, the enforcement of sanctions and international law. While victims of Kelp DAO seek quick compensation, decades-old terrorism rulings add to the complexity of an already challenging recovery process.

Disclaimer: The information presented in this article is the author's personal opinion in the field of cryptocurrencies. This is not financial or investment advice at all. Every investment decision should be based on careful consideration of your personal portfolio and risk tolerance. The opinion in the article does not represent the official position of the platform. We recommend that readers do their own research and consult experts before making any investment decisions.

Synthesized and analyzed by HCCVenture

Follow HCCVenture organization here: https://link3.to/holdcoincventure