A federal judge in Manhattan on May 8 allowed Arbitrum DAO to hold an onchain vote to transfer 30,765.67 ether (ETH) to a wallet controlled by Aave LLC. The funds, valued at about $71 million at the time, were frozen following the April 18 KelpDAO rsETH exploit.
Judge Margaret Garnett modified a restraining notice while leaving competing claims to the assets unresolved. Under the order, Aave LLC agreed to comply with the notice after receiving the ETH, preserving the restraint sought by creditors enforcing terrorism judgments against North Korea.
The order specifies that anyone initiating, voting on or participating in the authorized transfer would not violate the restraining notice. The court reserved decision on all other matters concerning the notice and the assets.
Recovery plan and governance vote
An earlier nonbinding Snapshot poll reportedly showed strong delegate support for releasing the ETH. That poll did not authorize a transfer. Moving the funds would still require a separate binding onchain vote and completion of the applicable governance and execution steps.
The April 25 recovery proposal, submitted by Aave Labs, KelpDAO, LayerZero, EtherFi and Compound, seeks to apply the frozen ETH toward restoring rsETH’s backing. The proposal says the Arbitrum Security Council immobilized the funds on Arbitrum One on April 21.
An April 20 incident report co-authored by Aave service providers said the exploit released 116,500 rsETH from KelpDAO’s bridge on Ethereum without a corresponding token burn on Unichain. The report said the attacker deposited 89,567 rsETH on Aave and that Aave’s smart contracts were not compromised.
Competing claims to the ETH
A restraining notice posted by attorney Charles Gerstein, who represents the judgment creditors, lists three judgments against North Korea totaling roughly $877 million before interest. The creditors contend that North Korea has an interest in the frozen ETH and that the assets can therefore be reached to satisfy those judgments.
LayerZero said preliminary indicators suggested the attack was likely attributable to North Korea’s Lazarus Group, specifically TraderTraitor. That preliminary attribution does not establish North Korean ownership of the disputed ETH.
Aave has argued that the assets belong to affected users and that an attacker does not gain lawful ownership simply by taking them. The May 8 order did not resolve that dispute.
Separate Railgun lawsuit
Many of the same judgment creditors brought a separate January lawsuit against Railgun DAO in Washington federal court. The plaintiffs allege that North Korean hackers used the privacy protocol to launder proceeds from earlier cyberattacks, including the Bybit exploit, and that Railgun should have frozen those assets for collection.
The complaint also alleges that Digital Currency Group participated in the DAO’s governance and business through its $10 million purchase of RAIL governance tokens in 2022.
In March, the plaintiffs reportedly asked the court clerk to enter default against Railgun DAO, saying it had failed to respond after being served.
