According to on-chain analyst ZachXBT and data from Arkham, the perpetrators of the $290 million KelpDAO heist have initiated the laundering process of their illicitly obtained funds. On Tuesday, during European hours, the wallet controlling the exploit proceeds made two transactions on the Ethereum blockchain, totaling $117 million and $58 million. ZachXBT discovered that a portion of the stolen cryptocurrency has started to be transferred across different blockchains. Approximately $1.5 million was moved from Ethereum to Bitcoin via Thorchain, while an additional $78,000 was routed through the Umbra privacy protocol.
Notably, North Korea's Lazarus Group has previously employed similar protocols, including Thorchain, for laundering purposes. The use of cross-chain transfers and privacy tools typically occurs during the initial 'layering' phase of money laundering, suggesting that the attacker may be preparing to further distribute the funds across various platforms. The KelpDAO breach is one of the most significant decentralized finance incidents in recent months, prompting a wave of negative sentiment throughout the DeFi sector and concerns about potential contagion spreading to other blockchains. Furthermore, Layer 2 network Arbitrum announced on Monday that it had frozen $71 million in ether linked to the hack, a move that may pressure the exploiter to expedite the transfer and laundering of the remaining funds.