On-chain sleuth ZachXBT has publicly accused U.S. law firm Gerstein Harrow LLP of attempting to seize approximately $71 million in frozen cryptocurrency assets linked to North Korea's Lazarus Group through fraudulent legal claims. The funds—30,766 ETH valued at roughly $71 million—were frozen by Arbitrum's Security Council following the April 2026 attack on KelpDAO, which saw Lazarus exploit a Layerzero V2 bridge vulnerability to steal about $290 million.
A Legal Stratagem Based on an Old Ruling
According to ZachXBT, Gerstein Harrow LLP is leveraging a 2015 U.S. court judgment from the case Han Kim et al. v. North Korea—stemming from the 2000 kidnapping of a South Korean reverend—to claim the frozen assets. The firm argues that the funds should be redirected to satisfy that decade-old ruling, effectively placing its clients ahead of the actual victims of the 2026 hack in any recovery queue. This tactic has stalled the return of assets to KelpDAO victims and given hackers more time to launder remaining proceeds.
ZachXBT: 'Pure Evil'
ZachXBT did not mince words: “This is a predatory U.S. law firm with a strategy that is pure evil,” he wrote on X, criticizing the firm for piggybacking on his own on-chain investigation that led to the freeze. He separately proposed that the crypto community form a decentralized autonomous organization (DAO) to coordinate legal action against the firm, a suggestion that garnered immediate and widespread support.
Expanding Legal Front in the Fight Against Hackers
The Lazarus Group has stolen over $6 billion in cryptocurrency since 2017, accounting for 76% of all crypto hack losses in 2026. The KelpDAO exploit followed a $285 million heist from Drift Protocol in early April. This legal maneuver introduces a troubling new dimension: using unrelated old court rulings to divert frozen hack proceeds. Whether the $71 million will ultimately reach KelpDAO victims or be rerouted through the courts remains to be seen.