Key Takeaways:
After Arbitrum froze 30,766 ETH ($71M), the KelpDAO exploiter moved 75,701 ETH ($175M) to the Ethereum mainnet. Peckshield confirmed the attacker is routing stolen funds to bitcoin through Thorchain, Umbra Money, and Chainflip. Lazarus Group’s KelpDAO haul provides to $600M+ in DeFi losses over three weeks as TVL falls 25%.
Arbitrum Freeze Triggers Rapid Response
The KelpDAO exploiter drained roughly $292 million from the liquid restaking protocol’s Layerzero-powered bridge on April 18, in what has develop into the biggest decentralized finance ( DeFi) exploit of 2026.
Earlier right now, the Arbitrum Safety Council executed an emergency freeze on 30,766 ETH ($71.15 million) held by the attacker on Arbitrum One. Dragonfly accomplice Haseeb Qureshi confirmed the council used a privileged system-level transaction to forcibly claw again the funds, fully bypassing the attacker’s pockets controls.
KelpDAO acknowledged the motion as properly, thanking the Safety Council and noting the group had labored carefully with the council and ecosystem stakeholders over two days to execute the intervention.
The freeze recovered roughly 29% of the ether the exploiter had amassed throughout chains following the unique breach.
Attacker Empties Handle, Routes Funds Towards Bitcoin
Following the Arbitrum freeze, the KelpDAO hacker moved all 75,701 ETH ($175 million) remaining on Ethereum and started laundering the funds. Safety agency Peckshield flagged the particular laundering route, highlighting that the exploiter bridged stolen funds in small batches to bitcoin through Thorchain, Umbra Money, and Chainflip. These decentralized protocols enabled direct cross-chain asset swaps between Ethereum and the Bitcoin community and not using a centralized middleman.
Peckshield additionally famous that lower than 0.768 ETH for fuel stays within the authentic exploiter tackle, that means the pockets has largely cleared out.
Layerzero attributed the unique KelpDAO assault to North Korea’s Lazarus Group and its Dealer Traitor subunit, citing onchain and operational ways per prior state-sponsored campaigns. Wu Blockchain knowledge reveals the KelpDAO hack has pushed complete DeFi losses above $600 million over the previous three weeks, because the broader ecosystem’s complete worth locked fell 25% to $82.4 billion.
