Onchain investigator ZachXBT has accused U.S. law firm Gerstein Harrow LLP of trying to take roughly $71 million in frozen assets tied to the KelpDAO exploit. The disputed pool consists of 30,766 ETH frozen after the April 2026 attack. ZachXBT says the firm’s claim would push real victims further back in the recovery line.
A claim built around an older court judgment
According to the source material, Gerstein Harrow LLP is seeking access to ether frozen in connection with the April 2026 KelpDAO exploit. Its argument relies on a 2015 U.S. court judgment in the Han Kim et al. case against North Korea. That ruling came out of the 2000 abduction of a South Korean reverend and is not directly tied to the current crypto hack.
Lazarus Group, the North Korean state-backed hacking operation, is suspected of draining about $290 million from KelpDAO on April 18, 2026 by exploiting a vulnerability in its LayerZero V2 bridge. In response, the Arbitrum Security Council froze 30,766 ETH, worth about $71 million at the time, through an emergency onchain action meant to stop further laundering.
ZachXBT says the tactic harms current victims
ZachXBT said the law firm is trying to redirect those frozen assets to satisfy the 2015 ruling, putting its clients ahead of people affected by the 2026 exploit. In a post on X, he described the strategy as “pure evil” and also criticized the firm for using research he had produced.
The source says ZachXBT’s investigative work helped build the evidence that led to the freeze. Anger inside the crypto community centers on the practical effect of the legal move: it can slow the recovery process, leave actual victims waiting, and give hackers more time to shift any remaining funds that were not frozen.
DAO proposal emerges as legal fight grows
ZachXBT also proposed forming a decentralized autonomous organization, or DAO, to coordinate legal action against the firm. That suggestion quickly drew support. For now, it remains unresolved whether the frozen funds will ultimately go to KelpDAO victims or be diverted through court proceedings.
The backdrop is large. Since 2017, Lazarus Group has stolen more than $6 billion in crypto, and the source attributes 76% of all crypto hack losses recorded so far in 2026 to the group. The KelpDAO case is not the only recent incident: roughly $285 million was taken from Drift Protocol in early April in what the source describes as another major Lazarus operation.
The dispute adds a new layer to hack recovery battles. The question is no longer only about tracing and freezing assets onchain, but also about who gets to claim them once the case moves into court.