Kelp DAO’s $71M Frozen ETH Nears Users After Court Fight

A federal court order and a cross-protocol rescue fund have collided over $71 million in frozen ether tied to the largest decentralized finance breach of 2026, leaving recovery timelines uncertain even as Kelp DAO prepares to reopen markets for the first time in nearly four weeks.

The dispute centers on 30,766 ETH seized by a blockchain governance body in April. Victims of a North Korean state hack are waiting for the funds. 

So is a group of American families with unpaid terrorism judgments against North Korea. 

A Manhattan federal court blocked distribution on May 1, and neither claim has been resolved.

How The April 18 Attack Drained $292 Million From Kelp DAO

On April 18, 2026, attackers linked to North Korea’s Lazarus Group stole roughly $292 million worth of rsETH from Kelp DAO’s LayerZero bridge. The attack targeted off-chain infrastructure, not the smart contract code itself. 

The attackers compromised internal RPC nodes and used distributed denial-of-service attacks against external nodes to feed false data into a single-point-of-failure verification network.

The attack worked because Kelp ran a 1-of-1 verifier configuration, meaning LayerZero Labs was the sole entity verifying bridge messages. 

LayerZero said its public integration checklist had recommended a multi-verifier setup and that a properly hardened configuration would have blocked the attack entirely.

The attacker used the stolen rsETH as collateral to borrow more than 82,600 ETH, worth about $195 million, from Aave. 

The bad debt triggered large withdrawals from Aave, causing its total value locked to fall by $6.28 billion in less than 48 hours.

How Arbitrum Froze The Funds, And What Happened Next

Arbitrum’s Security Council took emergency action to freeze approximately 30,766 ETH, worth over $71 million, tied to the exploit. 

Arbitrum said it acted with input from law enforcement, which had provided information about the exploiter’s identity. 

As of April 20 at 11:26 p.m. ET, the funds were transferred to an intermediary frozen wallet, where they can only be moved by further governance action.

The freeze set up a governance vote. More than 90% of Arbitrum DAO voters backed a proposal to release the frozen ETH tied to the Kelp DAO exploit. 

The recovery plan would move 30,765 ETH into a multisig wallet managed by Aave Labs, Kelp DAO, Certora, and EtherFi. 

More than 90.5% of participating voting power backed the proposal, with 173.9 million ARB tokens cast in favor.

Then a legal claim arrived. The U.S. District Court for the Southern District of New York issued a restraining order on May 1 barring Arbitrum DAO from moving the 30,766 ETH. 

The plaintiffs are families holding three unpaid terrorism judgments against North Korea, with claims totaling more than $877 million, excluding interest. 

Attorney Gabriel Shapiro reviewed the filing and wrote on X that Arbitrum DAO “is not allowed to do anything with the KelpDAO funds for now, until a divestiture hearing.” A hearing date has not been publicly confirmed.

DeFi United Races To Fill The Gap Without The Frozen ETH

With the court order stalling the frozen ETH, a separate rescue effort moved forward. Aave is at the center of a broad recovery effort, drawing in capital and credit commitments from across the industry. 

Consensys, alongside founder Joseph Lubin, committed up to 30,000 ETH in financial support. “The Ethereum ecosystem has always been at its best when it moves together,” Lubin said. 

“DeFi United is exactly that: a broad, coordinated response to protect users and strengthen the infrastructure we’ve all helped build.”

In total, DeFi United raised over $300 million in ETH commitments, enough to cover the full rsETH backing shortfall. 

The coalition used a controlled liquidation process to clear the attacker’s remaining positions. 

The recovered collateral was transferred to a Recovery Guardian multisig wallet managed by the DeFi United coalition. 

The next phase involves burning the liquidated rsETH on Arbitrum and combining seized assets with ETH committed by coalition partners to restore full rsETH backing before markets are reopened.

On May 13, 2026, Kelp DAO and Aave confirmed phase one of the recovery is complete. 

Kelp said it will refill 117,132 rsETH over two weeks and resume withdrawals within 24 hours of the first deposit, after completing security upgrades. 

Security hardening measures include raising verification requirements to four independent attestors from the previous single-verifier setup and increasing block confirmations from 42 to 64.

What Comes Next

The technical path is clearer than the legal one. rsETH operations are expected to resume within days, pending contract unpausing. 

The SDNY divestiture hearing, which will determine control of the 30,766 ETH, has no confirmed date. 

When Arbitrum’s Security Council froze the ETH on April 20, the centralized emergency action brought the assets within reach of U.S. courts, and that jurisdictional foothold is exactly what the plaintiffs’ lawyers used to file their claim. 

The case puts governance powers and legal jurisdiction on a collision course that the DeFi industry has not faced before.

ETH prices have not moved materially on the recovery news, consistent with earlier on-chain and social media chatter that treated the incident as a security story, not a macro one.