Introduction
When a decentralized autonomous organization (DAO) freezes stolen or exploited crypto assets, victims—especially those of high-profile state-sponsored hacks—face a unique legal and procedural challenge. In April 2024, Arbitrum DAO froze approximately $1.4 million in ETH linked to the Kelp exploit, allegedly orchestrated by North Korean hackers. A U.S. attorney representing victims of North Korean cyberattacks, Charles Gerstein, stepped in with a direct governance forum post on May 1, 2024, attempting to claim those frozen funds on behalf of his clients. This guide breaks down the exact steps used in that effort, providing a reproducible framework for legal professionals and victims seeking to recover frozen assets through DAO governance channels. Each step reflects real actions taken and legal principles applied.
Before you begin, ensure you have the necessary evidence, legal authority, and familiarity with the DAO's governance process. The steps below assume you are a qualified attorney or acting with legal counsel.
What You Need
- Legal representation – A lawyer experienced in blockchain law and cross‑border asset recovery.
- Evidence of victim status – Documentation showing you (or your clients) were directly harmed by the hack or exploit linked to the frozen assets.
- DAO governance knowledge – Understanding of the specific DAO's forum rules, voting mechanisms, and on-chain proposal systems.
- Public forum account – Registration on the DAO's governance platform (e.g., Arbitrum’s forum at forum.arbitrum.foundation).
- Legal rationale – A clear legal argument for why the frozen assets should be returned to you rather than held indefinitely or returned to the exploiters.
- Supporting documents – Court orders, affidavits, or official reports (e.g., from government cybersecurity agencies) linking the exploit to state‑sponsored hackers.
Step-by-Step Guide to Claiming Frozen DAO Assets
Step 1: Identify and Verify the Frozen Assets
Before filing any claim, you must precisely identify the assets that were frozen. In the Kelp exploit case, Arbitrum DAO froze approximately 1.2 million ARB tokens (converted to ETH) from a wallet linked to the attack. Work with on-chain analytics tools like Etherscan, Dune, or Nansen to trace the flow of stolen funds and confirm the freeze. Record the exact wallet addresses, transaction hashes, and the amount of each asset. This data will be crucial for your governance proposal and any subsequent legal action.
Step 2: Gather and Authenticate Victim Evidence
Compile irrefutable proof that your clients are legitimate victims of the same exploit. In the Arbitrum case, the attorney represented multiple past victims of North Korean state‑sponsored hackers. This required collecting FBI or Treasury Department sanctions lists, blockchain forensic reports, and sworn statements from victims. Ensure the evidence explicitly links the frozen assets to the harm suffered. A vague connection will likely be rejected by the DAO community.
Step 3: Draft a Formal Claim for the Governance Forum
Write a clear, legally‑grounded post on the DAO's official governance forum. The lawyer in this case posted directly to forum.arbitrum.foundation on May 1, 2024. Your post should include:
- Subject line – Direct and descriptive (e.g., “Claim for Return of Frozen ETH Linked to Kelp Exploit”).
- Background – Brief explanation of the exploit and how the assets were frozen.
- Victim identification – Describe who your clients are and why they are entitled to the assets.
- Legal basis – Cite laws or precedents (e.g., property rights under the U.S. Code, common law conversion, or DAO’s own terms of service) that support the return.
- Proposed action – Request that the DAO’s security council or multisig signers release the frozen ETH to a designated wallet.
- Call for discussion – Invite community feedback and signal willingness to engage in due process.
Use a professional tone; remember that governance forums are public and can be cited later in court. Do not make threats or demands – you are asking the DAO to act voluntarily.
Step 4: Engage With the DAO Community and Governance Process
After posting, monitor the thread for responses. In the real case, community members questioned the attorney’s standing and the legal enforceability of the claim. Be prepared to:
- Answer questions about jurisdiction (e.g., “Why should a U.S. court order apply to a decentralized organization?”).
- Provide additional documentation if requested.
- Offer to submit the claim to a formal off‑chain vote or arbitration if the DAO’s governance requires it.
- Coordinate with the DAO’s legal or security teams to ensure the process aligns with their internal rules.
Tip: If the DAO uses a signaling proposal mechanism, consider creating an on‑chain temperature check to gauge community support. For Arbitrum, a forum post is typically the first step before any formal governance proposal.
Step 5: Escalate Through Legal Channels If the DAO Refuses or Delays
If the DAO fails to act or rejects the claim after a reasonable period, you may need to pursue legal remedies. In the Kelp exploit case, the attorney’s forum post was a preliminary step before potential litigation. Options include:
- Obtaining a court order – File a lawsuit in a jurisdiction with jurisdiction over some DAO participants or validators.
- Subpoenaing off‑ramps – Target exchanges or fiat on‑ramps that could have received the frozen assets.
- Working with law enforcement – Use existing cooperation from bodies like the FBI, which already tracks North Korean hacker activity.
- Public pressure – Issue press releases to encourage community solidarity.
Important: The legal status of DAOs is still evolving. A court order may not be automatically enforceable on-chain. However, many DAOs prefer to comply voluntarily to avoid negative precedent and legal costs.
Tips for a Successful Claim
- Document everything – Keep a chronological log of all forum communications, votes, and off-chain discussions. This may be critical evidence if the case goes to court.
- Use existing precedents – Reference other DAO asset recovery cases (e.g., the inverse of the Oasis hack recovery or Wormhole). Show the community that returning stolen assets to victims is standard.
- Respect DAO governance norms – Rushing an on-chain vote without community consultation can backfire. Follow the DAO’s established proposal lifecycle.
- Consider jurisdictional angles – If your clients are U.S. residents and the hackers are sanctioned entities, highlight that holding the frozen assets could expose the DAO to secondary sanctions or legal liability.
- Be patient – DAO decision-making is often slow. The Arbitrum forum post was live for over a month before any official response. Persistence pays off.
- Seek media coverage – In high‑profile cases like North Korean hacks, media attention can pressure the DAO to act transparently.
Recovering frozen assets from a DAO is a new frontier at the intersection of law, technology, and community governance. The steps above, drawn from a real‑world attempt by attorney Charles Gerstein, provide a practical roadmap for victims. While no outcome is guaranteed, a well‑prepared, legally‑grounded claim significantly improves your chances.