Kelp DAO Hacker Launders Most of $220M
The attacker behind April’s Kelp DAO rsETH bridge exploit has laundered nearly all unfrozen proceeds from the attack, leaving about $1.7 million visible in the original tagged wallet.
On-chain tracking showed the movement involved most of the roughly $220 million that remained outside the assets frozen shortly after the hack.
April 18 Exploit Drained 116,500 rsETH
The April 18 exploit drained about 116,500 rsETH from Kelp DAO’s cross-chain setup. The stolen assets were worth roughly $292 million to $293 million at the time. Chainalysis said the attack was linked to North Korea’s Lazarus Group and was not a typical smart-contract bug.
The firm said the exploit abused off-chain verification infrastructure around Kelp DAO’s LayerZero bridge. The attacker was able to release rsETH on Ethereum against a non-existent burn on the source chain.
Arbitrum Freeze Preserved 30,766 ETH
Arbitrum’s Security Council froze a portion of the proceeds on April 21, blocking access to about 30,766 ETH.
The frozen assets were worth roughly $71 million and were moved into a governance-controlled wallet. That action captured around a quarter of the stolen funds and remains the clearest identified recovery pool.
Only $1.7M Remains in Tagged Wallet
The latest laundering update has sharply narrowed the visible recovery path. Most of the unfrozen balance has now moved out of the original wallet cluster. Analysts can still trace the funds, but recovery becomes harder once assets move through privacy and bridge routes.
The remaining practical recovery options appear to be the frozen Arbitrum funds, further law-enforcement coordination or a future operational mistake by the attacker.
Recovery Now Centers on $71M Frozen Fund
The frozen Arbitrum assets remain the main identified pool available for possible recovery. The laundering update shifts the Kelp DAO case from fast recovery to damage containment.
The next step is whether investigators, law enforcement or governance processes can recover any value beyond the funds already frozen.