Kelp DAO hacker launders almost all $220 million in stolen crypto

The hacker behind the Kelp DAO bridge exploit is laundering almost the full amount of approximately $220 million in unfrozen funds. On-chain analysis data shows that only about $1.7 million remains in the attacker’s original wallets. The chance of directly recovering the stolen money through transaction tracing is now largely closed.

North Korean Hackers Route Funds Through Privacy Networks

According to reporting by The Defiant, picked up by WuBlockchain, this involves the North Korean threat group TraderTraitor. This group is known for large-scale crypto attacks and uses advanced techniques to conceal stolen funds. The hackers are moving the money through a combination of privacy-focused protocols, including THORChain, Wasabi, Tornado Cash and Umbra.

Arkham Intelligence is tracking the movements on the blockchain and states that of the originally approximately $220 million in unfrozen assets, almost nothing can be traced anymore. The fact that only $1.7 million remains in the original exploit wallet indicates that the money laundering operation is nearly complete. The possibility of tracing and recovering assets one by one has therefore largely passed.

What Can Still Be Recovered

Not everything is lost. On 20 April, the Arbitrum Security Council froze $71 million in Ether, and this amount is currently considered the only materially recoverable part of the loot. That freeze forms a legal and technical anchor point for any further steps.

At the same time, a recovery process is underway at the protocol level. Kelp DAO is migrating the rsETH bridge functionality to Chainlink CCIP and presenting a so-called DeFi United plan to return approximately 116,000 rsETH to users. This restoration of infrastructure and the money laundering traces are two separate tracks: the protocol itself is operational again, but the chance of recovering the stolen money through on-chain tracing is now largely a dead end. The case illustrates once again how quickly large sums of crypto become untraceable via privacy tools if intervention is not swift enough.