According to on-chain analyst ZachXBT and data from Arkham, the perpetrators of the $290 million KelpDAO heist have initiated the laundering process of their illicitly obtained funds. Arkham's data reveals that the wallet controlling the exploit's proceeds executed two significant transactions, totaling $117 million and $58 million, on the Ethereum blockchain during European hours on Tuesday. Furthermore, ZachXBT's findings indicate that a portion of the stolen funds has begun to be transferred across different chains, with approximately $1.5 million being bridged from Ethereum to Bitcoin via Thorchain, and an additional $78,000 routed through the Umbra privacy protocol. Notably, North Korean hacking group Lazarus has previously employed similar protocols, such as Thorchain, for laundering purposes.
The use of cross-chain routing and privacy tools at this stage suggests that the attacker is likely preparing to further disseminate the funds across various platforms. The KelpDAO breach is one of the most substantial decentralized finance incidents in recent months, prompting a wave of negative sentiment and contagion fears within the DeFi sector.
In response to the hack, Layer 2 network Arbitrum has frozen $71 million in ether linked to the breach, potentially pressuring the exploiter to expedite the movement and laundering of the remaining funds.