A Manhattan federal court did not “clear” frozen crypto for normal use. Judge Margaret Garnett’s May 9, 2026 order instead modified a May 1 restraining notice so Arbitrum DAO can move 30,766 ETH, worth about $71 million, to an Aave-controlled wallet for recovery work while keeping the assets legally encumbered and preserving terrorism creditors’ claims.
The order changes custody, not ownership
The immediate change is procedural but important for DeFi operations. Arbitrum delegates approved the transfer with 182.2 million ARB tokens, or roughly 91% of voting power, allowing the protocol side of the recovery to proceed. The ETH is set to move from Arbitrum to Aave as part of the response to the April 18 Kelp DAO exploit, in which attackers minted 116,500 unbacked rsETH and then borrowed around $230 million in ETH from Aave.
The legal status of the funds did not become clean because of that vote or the court order. Plaintiffs representing terrorism judgment creditors, who say they hold $877 million in unpaid claims tied to North Korea, sought to restrain the assets on the theory that the funds are linked to Lazarus Group and APT-38. Garnett’s order protects participants carrying out the transfer from violating the restraining notice, but it does not resolve who ultimately has the superior claim to the ETH.
Why Aave asked for relief and what the judge refused to do
Aave had asked for more than a narrow modification. It filed an emergency motion seeking either a full lift of the restraining notice or, alternatively, a requirement that the plaintiffs post a $300 million bond. The court rejected both options. That matters because it shows the court was willing to facilitate technical recovery without giving the protocol a free hand over disputed assets.
Instead, the judge imposed a tighter structure: once transferred, Aave must be treated as though it had been directly served with the restraining notice. In practical terms, the ETH can sit inside the recovery process, but it remains subject to the litigation. If the plaintiffs later win attachment rights under the Foreign Sovereign Immunities Act or the Terrorism Risk Insurance Act, the funds could still be seized. That is the distinction readers should keep in view: this is a court-managed movement of assets under constraint, not a release of frozen property.
The recovery math behind the transfer
The transfer matters because the exploit created a real balance-sheet hole, not just a legal headache. After the attacker minted unbacked rsETH, the rsETH bridge was left with a shortfall of about 76,127 rsETH, estimated in the draft at roughly $174.5 million. Returning 30,766 ETH to Aave does not erase the entire deficit, but it reduces the gap and supports efforts to stabilize the protocol’s collateral position and loan-to-value ratios.
This is also why the order is notable for market structure, not just courtroom novelty. DeFi recoveries often depend on moving assets quickly through governance, custody, and protocol risk systems. A blanket freeze can preserve claims while still worsening insolvency or undercollateralization inside the protocol. The May 9 order effectively acknowledges that problem by allowing a constrained transfer mechanism rather than forcing a choice between total immobilization and unrestricted use.
Where the legal precedent is actually new
The novelty is not that a court interacted with crypto, but that it allowed a DAO-approved, on-chain recovery step to go forward while preserving adverse claims against the same assets. Gerstein Harrow, the law firm representing the terrorism creditors, has pursued similar theories against DeFi-related entities including Railgun DAO, arguing that protocols have been used to wash proceeds from North Korean-linked hacks, including funds allegedly connected to the Bybit exploit. Aave, for its part, disputes the attribution and has argued that excessive legal uncertainty could discourage protocols from helping recover stolen funds.
That tension is the real signal for crypto markets. Courts, protocols, and governance systems are starting to be treated as parts of the same asset-management chain during disputes. If that approach holds, future cases may not turn on whether assets are frozen in the abstract, but on whether a judge is willing to permit narrowly scoped on-chain actions that preserve both technical recovery and creditor rights.
The next checkpoint is on-chain, not final judgment
Nothing here is finished. There is still no hearing scheduled to determine final ownership or priority over the restrained ETH, and any later court action or appeal could change the status of the funds after transfer. The immediate operational checkpoint is the on-chain governance execution vote that would actually trigger movement of the 30,766 ETH.
For traders and protocol watchers, the cleanest distinction is between resolved execution risk and unresolved legal risk. ARB reportedly rose nearly 6% intraday as the binary question of whether the transfer could proceed moved toward resolution. But a tradable headline is not the same as legal closure. The useful monitor from here is whether execution completes as authorized, whether Aave handles the assets under the restraining conditions, and whether subsequent filings alter the court’s current framework.
| Point of confusion | What the order actually does | Why it matters |
|---|---|---|
| “The court cleared the ETH for Aave to use freely.” | It allows transfer to Aave for recovery purposes but keeps the funds legally encumbered. | Custody can change without ownership being settled. |
| “The Arbitrum vote resolved the dispute.” | The 182.2 million ARB vote approved protocol action, not the legal merits. | Governance can authorize execution, but courts still control attachment claims. |
| “The restraining notice was lifted.” | The May 1 notice was modified on May 9, not eliminated. | The plaintiffs’ terrorism-related claims remain active. |
| “This fixes the Kelp DAO exploit.” | It supports recovery against a larger shortfall caused by 116,500 unbacked rsETH. | The transfer reduces damage, but does not erase the full deficit or litigation risk. |
About the Author
