Briefing
- Judge Margaret Garnett of the Southern District of New York modified a restraining notice to allow Arbitrum DAO to transfer 30,765 ETH, worth roughly $71 million, to a wallet controlled by Aave LLC as part of a post-exploit recovery plan.
- The order also shields any participant in the onchain governance vote from liability under the original freeze, removing a legal deterrent that had stalled the transfer.
- The funds remain legally encumbered: terrorism judgment creditors represented by Gerstein Harrow LLP, who hold $877 million in unpaid judgments against North Korea, retain their claim and could compel Aave to hand over the assets if the court ultimately rules in their favour.
- The April 18 rsETH exploit on Kelp DAO released 116,500 rsETH on Ethereum without a corresponding burn, leaving a backing gap of approximately 76,127 rsETH worth around $174.5 million; the frozen ETH is seen as a partial offset.
- An off-chain Snapshot vote among Arbitrum delegates showed strong support for the transfer, but a separate binding onchain governance vote is still required before any funds move.
- The same creditor law firm sued Railgun DAO in January, alleging the privacy protocol laundered DPRK funds including proceeds from the $1.5 billion Bybit exploit, and in March sought default after Railgun allegedly failed to respond.
Analysis
- The court's framework, allowing transfer while preserving terrorism-judgment creditor claims that travel with the assets, creates a legal liability that Aave LLC now carries on its balance sheet. Any protocol or DAO receiving court-encumbered assets faces potential compelled turnover to judgment creditors. This precedent makes DeFi treasuries a viable attachment target for sovereign-judgment creditors, raising counterparty risk for protocols that hold large ETH or liquid-staking token positions originating from contested sources.
- The same law firm pursuing Arbitrum DAO also filed against Railgun DAO and is seeking default there. Two active SDNY actions against distinct DAOs in under six months establishes Gerstein Harrow as a repeatable enforcement mechanism for DPRK-linked fund recovery. Other DeFi protocols holding ETH traceable to the Bybit exploit or the rsETH incident face a materially higher probability of similar restraining notices, particularly those with identifiable governance token holders who can be served.
- The rsETH backing gap of approximately 76,127 rsETH worth roughly $174.5 million dwarfs the $71 million partial recovery, meaning Kelp DAO's liquidity shortfall remains unresolved even after the transfer. Liquid restaking token holders in rsETH face structural undercollateralization that a single governance action cannot cure. This will suppress rsETH secondary market liquidity and widen its discount to underlying ETH, with secondary effects on any lending protocol that accepts rsETH as collateral.
Historical Context
- Feb 2025
The $1.5 billion Bybit hack, attributed to North Korea's Lazarus Group, became the largest single crypto theft on record. Gerstein Harrow subsequently sued Railgun DAO alleging it laundered Bybit proceeds, directly linking the Bybit exploit to the same creditor litigation strategy now applied to the Arbitrum DAO funds.
- 2022-2023
US terrorism-judgment creditors successfully attached and liquidated Iranian sovereign assets held in US correspondent bank accounts, establishing that foreign-judgment creditors can compel turnover of assets held by third-party intermediaries. That mechanism is the legal precedent Gerstein Harrow is now extending to DeFi protocol treasuries.
- 2021
The US DOJ seized approximately 94,000 BTC linked to the 2016 Bitfinex hack by obtaining private keys held by the thieves rather than pursuing exchange counterparties. The Arbitrum/Aave case is structurally different: creditors are targeting identifiable governance entities rather than individual key-holders, marking a shift in enforcement vector toward protocol-level liability.
Connected Events
White House targets July 4 passage of Digital Asset Market Clarity Act
The Digital Asset Market Clarity Act, targeting a July 4 passage, does not currently address DeFi protocol liability for holding or transferring sanctioned or terrorism-linked funds. If the Gerstein Harrow actions generate additional SDNY precedent before the bill is finalized, Congress may face pressure to insert DeFi safe-harbor or liability language, complicating the legislative timeline.
Kraken parent Payward applies for OCC national trust bank charter
Kraken parent Payward's OCC national trust bank charter application, combined with its acquisition of Reap for cross-border stablecoin infrastructure, means regulated entities are building deeper institutional custody and payment rails into crypto at the same moment SDNY courts are establishing that DeFi protocol treasuries can be attached by judgment creditors. This divergence between regulated and unregulated custody risk will accelerate institutional preference for chartered custodians over self-governed protocol treasuries.
Further reading
See Indexa more often on Google
Mark Indexa as a preferred source — your Top Stories will surface more Indexa coverage.
