A dispute over stolen crypto from a recent DeFi hack is turning into a fight over who has the right to claim recovered funds.
The issue traces back to the April 18 exploit of KelpDAO, where attackers drained about $290 million. Investigators linked the breach to a subgroup of the Lazarus Group. Soon after, the Arbitrum Security Council stepped in and froze 30,766 ETH, worth roughly $70 million at the time, to stop the funds from being moved.
The freeze was meant to protect what remained so victims could eventually be repaid. Instead, it has drawn in a separate group with a different claim.
A U.S. law firm, Gerstein Harrow LLP, is asking a court to redirect the frozen ETH to its clients. Those clients won default judgments against North Korea years ago, with total damages reaching hundreds of millions of dollars. Their argument is that if the hackers are tied to North Korea, then the seized crypto should count as state-linked property and be used to settle those older claims.
A New York court has already taken a step in that direction. It issued a restraining notice and legal orders that block the Arbitrum DAO from moving the funds for now. That decision puts any repayment plan for KelpDAO users on hold.
Inside the crypto space, there had been early efforts to return the money. Aave Labs suggested sending the frozen ETH to a recovery setup called DeFi United, which would distribute compensation to affected users. That plan now faces uncertainty as the legal process plays out.
The situation has sparked strong reactions. Blockchain investigator ZachXBT, who helped trace the stolen funds, criticized the legal move. He argued that it puts unrelated claimants ahead of the actual victims of the hack. He also warned that long legal battles could slow recovery efforts and give attackers more time to move other assets that were not frozen.
There are also concerns about how this kind of claim could affect future cases. If courts start favoring older judgments over recent victims, it could change how recovered funds are handled across the industry. Some in the community have even discussed forming a DAO to organize a legal response.
This is not the first time Gerstein Harrow has gone after crypto tied to alleged North Korean activity. The firm has made similar claims in past cases involving frozen assets from other hacks. The strategy reflects a wider trend where traditional legal rulings are being used to claim digital assets linked to sanctioned groups.
The scale of activity linked to the Lazarus Group adds to the tension. The group has been tied to billions of dollars in stolen crypto over the past several years. Attacks connected to it continue to account for a large share of major losses in the sector.
What stands out here is how the process is changing. In the past, recovery efforts focused on tracking funds on-chain and freezing them where possible. Now, courts are playing a bigger role in deciding who gets what.
For now, the frozen ETH remains locked. The outcome will depend on how the court handles the competing claims. If the law firm succeeds, the funds could go toward settling older judgments. If not, they may still be used to repay victims.
Either way, this case is likely to shape how similar disputes are handled in the future.
