A US federal judge has authorized the transfer of roughly 30,765 ETH, valued at about $71 million, to a wallet controlled by Aave, clearing what appears to be the last major legal hurdle in the rsETH recovery process. The ruling marks a significant turning point in one of decentralized finance’s most complex post-exploit remediation efforts, allowing frozen assets to be redeployed toward stabilizing the damaged system.
Court Order Unblocks a Key Recovery Transfer
According to the report, Judge Margaret Garnett issued an order on May 9, 2026 modifying an earlier asset freeze and permitting the Arbitrum Security Council to send the frozen ETH to an address controlled by Aave LLC. The decision also shields governance participants and operators involved in carrying out the onchain decision from legal liability tied to the prior court order. In practical terms, that removes the uncertainty that had hovered over whether a community-approved governance action could actually be executed without exposing participants to personal legal risk.
The recovery effort stems from the April 18 exploit involving KelpDAO’s crosschain infrastructure. In that incident, attackers allegedly used unbacked rsETH as collateral on Aave V3 markets to borrow around $230 million in ETH from the protocol. After the exploit, the Arbitrum Security Council froze 30,765 ETH that remained trapped in the bridge, preserving a sizable portion of the assets and creating a foundation for a broader remediation strategy.
The frozen funds quickly became central to the DeFi sector’s response. Because the ETH had not yet fully escaped the bridge environment, it represented one of the few meaningful pools of recoverable value connected to the incident. That made the court’s approval especially important: without access to those funds, restoring confidence in rsETH and limiting fallout for Aave would have been far more difficult.
Legal Complexity Deepened by Lazarus Allegations
The case became more complicated when attorney Charles Gerstein, representing families holding roughly $877 million in unpaid terrorism-related judgments against North Korea, sought to block the transfer. His argument was that the frozen ETH could be subject to seizure because the April exploit had been widely attributed to the Lazarus Group, the North Korean state-linked hacking organization frequently associated with major crypto thefts.
That filing introduced a serious legal dilemma for the Arbitrum ecosystem. Even though an Arbitrum DAO governance vote reportedly passed with more than 90% support, there were open questions about whether implementing the transfer could expose tokenholders, governance voters, or operators to legal consequences under the standing freeze order. In other words, the decentralized governance process had reached a point where offchain legal reality could override onchain consensus.
Judge Garnett’s ruling resolved that impasse. By modifying the freeze order, the court allowed the ETH to move specifically to an Aave-controlled address while expressly protecting those involved in the governance-approved transfer from personal liability arising from the earlier restraint. The decision is notable beyond this single case because it highlights how DeFi governance, protocol security councils, and traditional courts are increasingly intersecting during crisis response.
From Emergency Containment to System Repair
With the legal barrier removed, the next stage focuses on using the released ETH to recapitalize the rsETH bridge and restore the 1:1 relationship between rsETH and its underlying ETH backing. That parity had been disrupted by the exploit, undermining confidence in the asset and threatening knock-on effects throughout lending markets where rsETH was used.
Aave co-founder Stani Kulechov said on May 9 that ETH loan-to-value metrics on Aave were already moving back toward normal parameters. That suggests the stabilization process had begun to show measurable progress once the legal uncertainty started to ease. In DeFi, the restoration of collateral integrity is often as important as direct recovery of stolen or frozen funds, because lending protocols depend on confidence in the value and redeemability of collateral assets.
The broader remediation campaign has also been unusually coordinated. The report states that five major DeFi protocols asked Arbitrum DAO to release the frozen ETH. In parallel, DeFi United, a coalition formed specifically to address the crisis, raised $160 million to help cover Aave’s exposure to bad debt created by the exploit. That level of cross-protocol mobilization reflects both the scale of the incident and the systemic importance of containing damage to one of DeFi’s largest lending venues.
A Major Test Case for DeFi Crisis Management
The rsETH incident exposed several structural vulnerabilities at once: bridge risk, the danger of undercollateralized synthetic or derivative assets, and the legal ambiguity that can emerge when decentralized systems interact with regulated legal frameworks. The exploit reportedly leaked 116,500 rsETH from Kelp’s OFT adapter, creating potential exposure of up to $230 million for Aave V3 markets across Ethereum and Arbitrum. What followed was not just an exploit response, but a coordinated effort involving protocol teams, governance bodies, legal counsel, and emergency financing backstops.
That makes this ruling more than a procedural update. It is a concrete example of how DeFi recovery processes may increasingly require a blend of technical containment, governance coordination, and judicial clarity. Onchain votes alone were not enough to complete the transfer; at the same time, the eventual court order was crafted to accommodate the realities of decentralized governance and operational execution.
For Aave, the immediate takeaway is straightforward: a meaningful tranche of ETH can now be used in the final stages of repair. For rsETH holders and the wider market, the decision improves the odds of restoring backing and reducing residual contagion risk. And for the DeFi industry, the episode may become a reference point for how to handle future large-scale exploit recoveries when frozen assets, governance approvals, and competing legal claims collide.
While the exploit itself remains a reminder of the persistent risks surrounding bridges and wrapped staking assets, the latest court-approved transfer indicates that the remediation effort is entering its closing phase. If the recapitalization of the bridge proceeds as planned, the rsETH recovery could soon shift from emergency response to long-term normalization.