KelpDAO Exploiter Bridges Stolen Funds to Bitcoin
The exploiter of KelpDAO is transferring stolen funds to Bitcoin using THORChain. This move is part of the ongoing fallout from the hack. The post alerts the community to these transactions.
DYOR - Single Source
This feed has limited sources. Do your own research before making decisions.
Sources (1)
AI Research
Key Takeaway
The KelpDAO exploiter is leveraging THORChain's permissionless cross-chain swaps to move $175 million into Bitcoin, an asset that is significantly harder to freeze than the Ethereum-based tokens originally stolen.
Capital Flight to the Orange Network: Analyzing the KelpDAO Exploiter's Bitcoin Bridge
On April 18, 2026, the decentralized finance (DeFi) ecosystem was rocked by the largest security incident of the year: the $292 million exploit of KelpDAO. While the initial breach—attributed to the North Korean state-sponsored Lazarus Group—sent shockwaves through liquid restaking protocols, the focus has now shifted to the sophisticated laundering operation currently underway. Recent on-chain data reveals the exploiter is aggressively bridging stolen funds to Bitcoin (BTC) using the decentralized liquidity protocol THORChain.
The Anatomy of the KelpDAO Breach
The exploit targeted KelpDAO’s rsETH bridge, which relied on a LayerZero-powered verifier network. Investigators discovered the protocol utilized a "1-of-1" verifier configuration, a critical single point of failure that the attackers exploited via a combination of social engineering and a distributed denial-of-service (DDoS) attack. By isolating the single verifier, the hackers were able to inject forged cross-chain messages, allowing them to mint approximately 116,500 unbacked rsETH.
This unbacked collateral was immediately cycled through lending giants like Aave and Compound, where the attackers borrowed native ETH and other liquid assets, leaving Aave with an estimated $177 million in bad debt. The resulting contagion wiped out nearly $15 billion in Total Value Locked (TVL) across the DeFi sector within 48 hours.
The Pivot to Bitcoin via THORChain
Following a swift response from the Arbitrum Security Council, which managed to freeze roughly $75 million (30,766 ETH) of the stolen assets, the exploiter accelerated their exit strategy. On April 21, on-chain analytics began flagging massive outflows from the exploiter’s primary wallets.
Key details of the laundering operation include:
- Asset Conversion: Approximately 75,700 ETH (valued at ~$175 million) was converted into native Bitcoin.
- The THORChain Route: The hacker bypassed centralized exchanges by utilizing THORChain, a non-custodial, cross-chain protocol that facilitates native swaps (e.g., ETH to BTC) without KYC requirements.
- Fees and Volume: These transactions generated over $910,000 in fees for the THORChain network, highlighting the protocol’s role as a double-edged sword: a beacon of financial sovereignty that can also be exploited by malicious actors.
Why Bitcoin?
For sophisticated threat actors like the Lazarus Group, Bitcoin remains the ultimate "exit ramp." Unlike ERC-20 tokens or Layer-2 assets, which can often be blacklisted or frozen by central authorities and security councils, native Bitcoin is nearly impossible to freeze once it settles on the mainnet. By moving to the Bitcoin network, the exploiter can further fragment the funds through mixing services like CoinJoin or privacy-preserving tools like Umbra, significantly complicating the task of blockchain forensic firms.
Historical Context and Market Implications
This maneuver follows a blueprint established in previous major hacks, such as the Euler Finance and Balancer exploits, where attackers prioritized moving assets to Bitcoin to escape the reach of smart contract "circuit breakers."
For the broader market, this incident raises two critical concerns:
- Regulatory Scrutiny on Bridges: Protocols like THORChain and LayerZero will likely face renewed pressure to implement "protocol-level" compliance measures, despite their decentralized nature.
- The Restaking Risk: The KelpDAO event exposes the systemic risks of liquid restaking tokens (LRTs). When these derivative assets are used as collateral across multiple layers of DeFi, a single bridge failure can cause a catastrophic deleveraging event.
Looking Forward
The KelpDAO exploit marks a turning point for DeFi governance. As the exploiter successfully settles into the Bitcoin network, the window for fund recovery is rapidly closing. The industry must now grapple with the trade-off between the "permissionless" nature of decentralized bridges and the need for robust, multi-signature security architectures to protect the billions of dollars flowing across chains. Expect a shift toward mandatory multi-verifier DVNs and enhanced real-time monitoring of cross-chain liquidity pools in the coming months.