Federal court clears Arbitrum vote to move frozen ETH into Aave custody

On May 9, 2026, a two-page federal court order became the clearest legal development in the recovery fight over ether immobilized after the rsETH incident. The order, signed on May 8 by Judge Margaret M. Garnett of the U.S. District Court for the Southern District of New York, modified a restraining notice served on “Arbitrum DAO.” It allowed an onchain vote to transfer the disputed assets to a digital-asset wallet controlled by Aave LLC.

The distinction mattered: the court authorized a custody change, not distribution to users. Aave LLC agreed that the restraining notice would follow the assets. The company could not treat the ether as free for sale, lending, staking or repayment while the notice remained in force.

A narrow compromise

The order arose in *Kim v. Democratic People’s Republic of Korea*, case 1:25-mc-00527. Judgment creditors seeking to enforce terrorism-related judgments against North Korea argued that the immobilized assets could be attached because the hackers were allegedly connected to the country. Aave asked the court to vacate the restraint.

Judge Garnett did not decide who owned the ether or whether it could ultimately fund the rsETH recovery. The court instead created a narrow operating path: Arbitrum participants could initiate, vote on and carry out a transfer to Aave LLC without violating the notice. The order expressly reserved every other question involving the restraint and the assets.

That clarification reduced one immediate governance risk. Before the order, delegates faced uncertainty about whether participating in an onchain transfer might conflict with a judicial restraint directed at a decentralized organization. By separating the vote from the ultimate disposition of the assets, the court preserved both the onchain process and the creditors’ asserted claim.

The protocol damage behind the case

Aave’s April 20 incident report said a bridge-adapter balance fell from 116,723 rsETH one block before the April 18 exploit to 223 rsETH immediately afterward. The report said the attacker received 116,500 rsETH and deposited 89,567 rsETH into Aave positions. Its table recorded 82,650 WETH and 821 wstETH borrowed against those positions, while warning that the borrowed amount increased as interest accrued.

Those figures were a protocol-risk assessment based on public onchain data as of April 20, not a final judicial finding or a complete loss calculation. Aave also said its guardians began freezing rsETH and wrapped-rsETH markets at approximately 19:00 UTC on April 18 and froze WETH borrowing across several deployments at approximately 02:00 UTC on April 20 as a containment measure.

For May 9 reporting, The Block described the immobilized pool as approximately 30,766 ETH worth about $71 million. That dollar figure was a contemporaneous rounded estimate attached to its 5:02 p.m. EDT publication. The report did not identify a pricing venue, benchmark or precise valuation timestamp, so $71 million should be read as an indication of scale, not an independently reproducible market close.

Why the order mattered

The case joined three systems that normally resolve disputes in different ways: smart-contract execution, tokenholder governance and court-supervised creditor process. Arbitrum’s technical ability to move funds did not eliminate legal claims, while the restraining notice did not itself execute an onchain transaction. The May 8 order supplied a bridge between them by identifying a permitted transfer and a legally accountable custodian without deciding the final destination.

As of May 9, 2026, no completed transfer under the modified order had been established in the cited record. Nor had the court adjudicated the allegation that the exploit proceeds were North Korean property. The central verified development was therefore procedural but consequential: governance could advance a custody transfer, while the ether remained legally frozen and the ownership contest stayed open.