Arbitrum DAO Votes to Unlock $70 Million for Kelp DAO Exploit Relief

Arbitrum DAO passed a governance vote on Thursday approving the release of roughly $70 million in frozen ETH to a coordinated recovery effort aimed at making victims of the Kelp DAO rsETH exploit whole, though a U.S. federal court order could still block the transfer.

The proposal, co-authored by Aave Labs, KelpDAO, LayerZero, EtherFi, and Compound, passed with 182.2 million votes in favor, about 90.96%, against negligible opposition.

The 30,765.67 ETH was frozen by the Arbitrum Security Council last month, days after an attacker exploited a flaw in Kelp’s LayerZero-powered cross-chain bridge, releasing 116,500 rsETH on Ethereum without a corresponding source-side burn.

The attacker then used the unbacked rsETH as collateral on Aave to drain roughly $230 million in ETH belonging to protocol users.

What next?

The vote settles where the funds will go, approving their transfer to a 3-of-4 Gnosis Safe controlled by representatives from Aave, KelpDAO, EtherFi, and Certora, to be used exclusively for the rsETH recovery effort.

But a restraining notice filed on May 1 in the Southern District of New York now clouds the execution path.

Plaintiffs holding decades-old unpaid judgments against North Korea, citing online attribution of the hack to the Lazarus Group, obtained court permission to serve the notice on Arbitrum DAO, noting the frozen ETH constitutes DPRK property subject to seizure to satisfy their judgments.

In a Monday filing, Aave LLC asked the court to vacate the restraining notice as baseless and, if it remains, require plaintiffs to post at least a $300 million bond, arguing the freeze is causing immediate and irreparable harm to users.

“The honest answer is: technically possible, but practically suicidal for anyone whose name is on the execution,” Yuriy Brisov, partner at Digital & Analogue Partners, told Decrypt, when asked whether the restraining notice makes execution legally impossible.

“The New York Court of Appeals decided in Aspen Industries v. Marine Midland Bank that a restraining notice ‘serves as a type of injunction,'” Brisov said. “CPLR §5251 then makes the consequence explicit: refusing to obey it is punishable as contempt of court.”

The private keys still sign, he noted, and the chain does not care about a New York court, but every identifiable person in the execution chain has now been served.

“Once those persons have actual knowledge of the notice, moving the ETH is contempt,” the expert added.

The indemnity “does not cover contempt liability,” meaning anyone executing the transfer could face being held in contempt of court, and the “realistic question,” Brisov said, is whether anyone in the U.S. would take that risk—explaining why Aave is challenging the freeze on its merits rather than arguing the chain is beyond U.S. reach.

On whether a favorable ruling would restore execution, Brisov said “for this specific transfer, yes,” but not more broadly, explaining the case hinges on the Security Council’s April 21 action that “proved… a control point exists”—meaning even if the freeze is lifted, “future plaintiffs now have a roadmap” for similar claims.

“Lifting one notice does not lift the visibility of the architecture that invited it,” he said.

Lifting the freeze “removes the most immediate obstacle,” but the vote isn’t self-executing, Alice Frei, head of legal and compliance at OMI, told Decrypt, noting the release still depends on full governance steps and ongoing legal risk, as plaintiffs may continue to challenge whether the ETH is “attachable property,” meaning even a win for Aave won’t guarantee a “clean run” to execution.

The Kelp DAO exploit prompted a “DeFi United” recovery effort that raised over $300 million, with the 30,765 ETH frozen on Arbitrum covering part of an estimated 76,127 rsETH shortfall, while the proposal itself carries no new cost to the DAO.