- KelpDAO attacker converts 75,700 ETH into BTC within 36 hours using THORChain.
- Arbitrum freezes 30,766 ETH tied to an exploit, securing funds via governance control.
- $290M exploit triggers $15B DeFi outflows as laundering shifts funds across chains.
The attacker behind the KelpDAO exploit has shifted a large portion of stolen funds, converting approximately 75,700 ETH, valued at about $175 million, into Bitcoin within roughly 36 hours. The activity followed a recovery effort on the Arbitrum network, during which 30,766 ETH linked to the exploit were frozen and moved to a secure address.
Most of the ETH-to-BTC conversions were executed through THORChain, a protocol built to facilitate direct swaps between different blockchains without intermediaries. Due to the scale of the transactions, the activity generated approximately $800 million in trading volume on the platform and produced around $910,000 in fees. Almost all the remaining ETH holdings were converted within about a day and a half.
Related: KelpDAO Hacker Moves Stolen ETH, Funds Routed to Tron via LayerZero
Arbitrum Freezes Portion of Funds
Prior to the conversion activity, a portion of the stolen assets had been moved onto Arbitrum. In response, the Arbitrum Security Council implemented emergency measures to secure 30,766 ETH associated with the exploit. The funds were transferred to a specific address under network control, making them inaccessible to the attacker without further governance action.
The intervention followed coordination with law enforcement and involved technical steps designed to isolate the funds without disrupting other users or applications on the network. As a result, the recovered ETH remains frozen pending additional decisions by Arbitrum governance.
Laundering Activity and Broader Impact
After losing access to the Arbitrum-based funds, the attacker continued transferring ETH from the Ethereum network. Several smaller transactions were routed through privacy-focused tools, such as UmbraCash, before the bulk conversion to Bitcoin.
The exploit itself, which occurred on April 18, resulted in the loss of 116,500 rsETH, valued between $290 million and $293 million. The incident has been identified as one of the largest decentralized finance losses recorded in 2026.
In the aftermath, approximately $15 billion was withdrawn from DeFi platforms. Separate reports indicate that attackers linked to North Korea stole close to $600 million from on-chain applications in the first quarter, with the KelpDAO incident adding to a series of high-value breaches during the period.
Related: North Korea’s Crypto Heist Strategy Deepens with KelpDAO Hack
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
