Arbitrum Security Council Transfers $71 Million in Frozen Ethereum to Aave; Legal Battle with North Korean Terrorism Creditors Continues

On May 9, 2026, Judge Margaret Garnett of the U.S. District Court for the Southern District of New York issued an order authorizing the transfer of approximately $71 million worth of Ethereum (ETH) frozen on Arbitrum to a wallet managed by Aave. While the ruling is considered a temporary victory for Aave LLC in its efforts to recover assets lost in a North Korea-linked hacking incident, the legal dispute has entered a new phase as legal representatives for North Korean terrorism victims maintain strong seizure rights over the assets.

Under Judge Garnett's order, the Arbitrum Security Council is permitted to transfer approximately 30,765 ETH to a wallet address controlled by Aave LLC. Notably, the order includes provisions protecting Arbitrum governance participants who voted for the transfer from legal liability for potentially violating existing asset freeze orders. This establishes a legal foundation for moving the assets to a secure location following a security incident that occurred last month.

The Arbitrum Security Council's swift action to block the movement of stolen assets is considered a rare success in cryptocurrency asset recovery.

The dispute stems from the rsETH exploit of KelpDAO in April 2026. At the time, a hacker attempted to steal assets by exploiting a vulnerability, but the Arbitrum Security Council responded immediately, successfully freezing the assets on-chain before they could be moved out. This rapid response has drawn industry attention as an exceptional case that increased the possibility of asset recovery within the decentralized finance ecosystem.

Intervention of North Korean Terrorism Victim Creditors and Legal Issues

However, on May 1, 2026, the situation became complicated when a legal team representing the families of North Korean terrorism victims filed a petition for seizure of the assets. In a 30-page response submitted on May 5, they argued that the frozen assets should be considered property of the North Korean government and therefore should be paid out as restitution for terrorism victims. This argument is interpreted as an attempt to redefine the nature of the assets as 'North Korean assets' rather than 'property of hacking victims.'

• April 20, 2026: Arbitrum Security Council freezes 30,766 ETH related to KelpDAO
• May 1, 2026: North Korean terrorism victim creditors file a petition for asset seizure
• May 5, 2026: Creditors' counsel submits a 30-page response claiming asset ownership
• May 9, 2026: Court issues an order authorizing the asset transfer to Aave

Aave is strongly resisting the seizure attempt, emphasizing that the assets belong to individual users who suffered from the exploit, not the North Korean state. On-chain analyst ZachXBT criticized the creditors' legal strategy as 'predatory,' pointing out that attempts to use publicly recovered assets for terrorism restitution could hinder recovery efforts within the DeFi ecosystem. Aave's legal team is focusing on proving that the assets never entered the control of North Korea.

The beginning of 2026 was a period of unprecedented activity by North Korean hackers. According to reports, North Korea-linked organizations accounted for 76% of the $635 million in cryptocurrency hacking losses in April 2026 alone, which included the $285 million breach of Drift Protocol. Against this backdrop, the KelpDAO assets became a legal target as they were considered a fraction of North Korea's cybercrime proceeds.

While this court order moves the assets to Aave, it does not signify full recovery or a return to users. Aave is currently serving more as a custodian of the assets, and the possibility remains that it will be legally obligated to hand them over if the court eventually rules in favor of the terrorism victims. Consequently, the transferred $71 million is expected to remain locked under Aave's control until the legal dispute is resolved.

The upcoming divestiture hearing is expected to be a turning point in determining the final destination of these vast assets. Depending on whether the court views these as North Korean property or assets to be returned to the original DeFi users, it will set a significant precedent for asset recovery practices and the scope of legal protection in the cryptocurrency industry. Industry experts analyze that this case will serve as an important test of the interaction between DeFi protocol governance and the judicial system.

In conclusion, the May 9, 2026 ruling is a step forward for the safe storage of assets, but the fundamental conflict over ownership remains unresolved. The Arbitrum and Aave communities must watch the legal battle without being able to secure the liquidity of the assets until a final court ruling is issued. As North Korean cyber threats continue, the eyes of the global cryptocurrency market are focused on how the legal interpretation regarding the definition of victimized assets will be rendered.