According to on-chain analyst ZachXBT and data from Arkham, the perpetrators of the $290 million KelpDAO heist have initiated the laundering process of their illicit gains. On Tuesday, during European hours, the wallet controlling the exploit's proceeds made two transactions on the Ethereum blockchain, totaling $117 million and $58 million. ZachXBT has reported that a portion of the stolen funds is being transferred across different blockchains, with approximately $1.5 million being bridged from Ethereum to Bitcoin via Thorchain, and an additional $78,000 routed through the Umbra privacy protocol. Notably, the North Korean hacking group Lazarus has previously employed protocols like Thorchain for laundering purposes.
The use of cross-chain routing and privacy tools at this stage suggests that the attacker is likely preparing to further distribute the funds across various platforms. The KelpDAO breach is one of the most significant DeFi incidents in recent months, triggering a wave of negative sentiment and concerns over potential contagion across the sector. In response, the Layer 2 network Arbitrum has frozen $71 million in ether linked to the hack, which may pressure the exploiter to expedite the movement and laundering of the remaining funds.