Proponents of Ethereum will say that smart contracts obviate the need for courts. I don't think this sort of Ethereum bug/hack thing has ever shown up in the court system yet. I'm sure someone will bring a case if they know who did it. If gaining access to someone's system using default credentials or no credentials is a violation of the CFAA then I'm sure this is as well.