Kelp DAO Exploiter Laundered $80M in ETH Mostly via THORChain

An attacker who drained $292 million from the LayerZero-powered cross-chain bridge Kelp DAO has laundered roughly 34,500 ETH, about $80 million, according to onchain analyst EmberCN. EmberCN's blockchain tracing showed the exploiter moved about $175 million in ETH off Ethereum on Tuesday and that Arbitrum froze 30,766 ETH tied to the theft.

Blockchain records indicate most of the remaining ETH was converted to Bitcoin through THORChain. THORChain's dashboard showed $394 million in swap volume over a 24-hour period and roughly $456,000 in fee revenue, well above the protocol's typical daily volume of $10 million to $35 million.

THORChain is a non-custodial cross-chain swap protocol and does not hold user funds. The project wrote that it was “modelled after Bitcoin, to be permissionless and censorship resistant” and that “there's no single person or entity in control of the protocol. There's no admin key. There's no 2-of-3 multisig … THORChain is neutral because the code is neutral, and the nodes enforce it.”

Security researchers and LayerZero have identified North Korea's Lazarus Group as the likely actor behind the Kelp DAO exploit. THORChain has been used in prior laundering chains attributed to actors linked to Lazarus, including conversions of stolen ETH to BTC after large exchange hacks.

The initial theft exploited a bridge built on LayerZero's cross-chain messaging technology, producing the $292 million loss. The Arbitrum Security Council's freezing of 30,766 ETH occurred on the layer-2 network, and the remaining funds were moved through cross-chain routes and swaps.

Analysts tracking the funds noted that cross-chain swap routes and decentralized, permissionless protocols were used to move and convert the assets rapidly. THORChain's spike in fee revenue corresponded with the period of high swap volume tied to the incident.