{"id":324,"date":"2026-04-23T14:41:13","date_gmt":"2026-04-23T14:41:13","guid":{"rendered":"https:\/\/1stblock.info\/?p=324"},"modified":"2026-04-23T14:41:13","modified_gmt":"2026-04-23T14:41:13","slug":"kelp-dao-exploiter-launders-stolen-eth-through-thorchain","status":"publish","type":"post","link":"https:\/\/1stblock.info\/?p=324","title":{"rendered":"Kelp DAO Exploiter Launders Stolen ETH Through THORChain"},"content":{"rendered":"\n<p>The exploiter behind the significant Kelp DAO hack, which resulted in approximately $293 million in losses, has successfully laundered nearly all of the unfrozen Ether stolen during the attack. This development has narrowed recovery efforts to the portion of funds that Arbitrum\u2019s security council managed to freeze.&nbsp;<\/p>\n\n\n\n<p>The hacker laundered nearly all of the 75,700 Ether (ETH) taken from the protocol on Saturday, primarily utilizing THORChain to convert the Ether into Bitcoin (BTC). This process generated around $910,000 in fee revenue for the protocol, as reported by blockchain analyst EmberCN in a recent post. The attacker began transferring the stolen funds on Tuesday, moving approximately 75,700 ETH, valued at about $175 million at that time, into newly created wallets. These assets were subsequently routed through THORChain and the privacy protocol Umbra.&nbsp;<\/p>\n\n\n\n<p>Data from Arkham indicates that the attacker\u2019s main wallet has been largely emptied by Thursday. The use of THORChain complicates the tracing of these funds, thereby diminishing the likelihood of recovery. Arkham&#8217;s report noted that the transaction patterns suggest the attackers are executing an exit strategy rather than holding onto the proceeds.&nbsp;<\/p>\n\n\n\n<p>In a separate action, Arbitrum\u2019s security council managed to freeze 30,766 ETH associated with the exploit, transferring these funds into an intermediary wallet that will require further governance action to access. The attacker laundered the remaining funds just five days after draining about 116,500 restaked Ether (rsETH), worth roughly $290 million to $293 million, from Kelp DAO\u2019s LayerZero-powered rsETH bridge on Saturday.<\/p>\n\n\n\n<p>The impact of the exploit has reverberated across decentralized finance (DeFi) applications, including Aave, where the hacker utilized the stolen funds as collateral to borrow against the protocol, creating an estimated $195 million in bad debt. Aave is currently collaborating with affected protocols to devise a resolution that mitigates the contagion effect of the exploit. Aave&#8217;s founder and CEO, Stani Kulechov, emphasized in a recent post that the priority remains the users, with decisions aimed at restoring normal market conditions.<\/p>\n\n\n\n<p>Kelp DAO has also expressed progress towards a suitable resolution, focusing on safeguarding users and strengthening the protocol. Aave\u2019s risk provider outlined two potential scenarios regarding the bad debt: one could lead to approximately $123.7 million in bad debt, while the other could result in about $230.1 million. The first scenario would distribute losses among all rsETH holders on Ethereum mainnet and layer-2s, potentially causing a 15% depeg in rsETH relative to Ether. The second scenario would allocate the entire loss to rsETH holders on Ethereum layer-2s, leaving Aave with $230 million in bad debt.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The exploiter behind the significant Kelp DAO hack, which resulted in approximately $293 million in losses, has successfully<\/p>\n","protected":false},"author":2,"featured_media":189,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[2],"tags":[],"class_list":["post-324","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-last-news"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/posts\/324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=324"}],"version-history":[{"count":1,"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/posts\/324\/revisions"}],"predecessor-version":[{"id":325,"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/posts\/324\/revisions\/325"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/media\/189"}],"wp:attachment":[{"href":"https:\/\/1stblock.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}