Court approves move of $71M hacked ETH

TLDR

A US judge has allowed about $71 million in hacked Ether to be moved into Aaves control as part of the rsETH exploit recovery.

1. Judge Margaret Garnett modified a restraining notice so Arbitrum maker/">DAO can transfer roughly 30,765 ETH to an Aave-controlled wallet while shielding DAO voters from liability.
2. The ETH, frozen after the KelpDAO rsETH exploit, will help recapitalize the rsETH bridge and Aave, but the funds remain legally encumbered by terrorism victims claims.
3. This sets an important precedent for how courts, DAOs, and DeFi protocols coordinate in future hacks, with further rulings still needed on ultimate ownership of the ETH.

Deep Dive

1. What The Court Actually Approved

Reports say a Manhattan federal judge, Margaret Garnett, modified an earlier restraining notice so Arbitrum DAO can execute an onchain vote to move about 30,76530,766 ETH (around $71 million) to a wallet controlled by Aave LLC.

The order clarifies that anyone initiating, voting on, or technically participating in the transfer will not violate the restraining notice, removing the main legal risk that had stalled execution of an already approved Arbitrum DAO governance proposal.

Crucially, the restraining order still follows the assets. It does not hand clear title of the ETH to Aave: it simply permits the transfer into Aaves orbit as part of the recovery plan described in coverage from outlets like CoinDesk and The Block.

2. Impact On Aave, rsETH And Arbitrum

The ETH in question was frozen by the Arbitrum Security Council after the April KelpDAO rsETH exploit, in which unbacked rsETH was used as collateral on Aave V3 to drain hundreds of millions in ETH, leaving a large shortfall in rsETH backing and bad debt on Aave.

Aaves recovery plan uses this recovered ETH to recapitalize the rsETH bridge, restore the 1:1 backing of rsETH with underlying ETH, and normalize Aaves loan to value settings, with Aave and Arbitrum governance already backing the plan in earlier off chain and onchain votes.

DeFi United, a coalition backing the recovery, has raised substantial additional capital, and this 30k-plus ETH transfer is described as the single largest contribution to closing the rsETH gap and stabilizing Aave-linked DeFi markets.

3. Remaining Legal Risks And Precedent

The terrorism victims represented by Gerstein Harrow LLP still assert claims on the ETH, arguing it is North Korean property via attribution of the KelpDAO exploit to the Lazarus Group; the court has not yet ruled on ultimate ownership.

That means Aave cannot treat the ETH as fully free capital. If the plaintiffs eventually win, some or all of these assets could be seized or redirected, and the restraining order explicitly continues to apply to Aave LLC.

This episode is also a major governance and legal precedent: a US court has both constrained and then unlocked a DAOs ability to move exploited funds while directly addressing liability for governance participation, which will influence how future DeFi recovery votes are structured and coordinated with traditional courts.

Conclusion

The courts decision unlocks a critical pool of hacked ETH for Aaves rsETH recovery, easing immediate systemic risk for Aave and Arbitrum users while leaving deeper ownership questions unresolved. DeFi participants gain a clearer template for coordinating onchain governance with off chain courts, but the case also highlights that hacked crypto, especially when linked to sanctioned states, can remain legally contested long after technical exploits are contained.