Kelp DAO hack: attacker drains nearly all $293M ETH, leaving only frozen funds
Natalia Ivanov2026-05-06
After the $293M Kelp DAO hack, attacker rapidly laundered ETH via THORChain and mixers, leaving only frozen Arbitrum funds recoverable as tracing options fade.
The attacker responsible for the approximately $293 million Kelp DAO hack has allegedly executed a quick-flip laundering operation, transferring almost all of the melted-away ETH out of statistical trading activity days after the looting. This has greatly reduced potential recovery options to just the remaining frozen funds in Arbitrum’s security governance.
Rapid Movement of Stolen Funds
Blockchain tracking indicated that the attacker started to distributing the stolen funds on Tuesday, only a few days after the exploitation (on Saturday when about 116.500 restaked Ether (rsETH was siphoned from the Kelp DAO LayerZero-based bridge protocol). The stolen deposits were worth about $290 million to 293 million dollars at the time.
The attacker started by gathering approximately 75,700 ETH into new wallets at the then Marktvalue of roughly $175 million. This step, common at the beginning of hutching exploits, serves to disconnect the exploit transaction from the laundering process.
The money was then sent through several cornered cash states utilizing a range of decentralized privacy and liquidity tools in an effort to mask the transaction trail and ownership trail.
Use of THORChain and Privacy Tools
A large fraction of laundering is thought to have passed through THORChain a cross-chain liquidity network that facilitates swaps between disparate chains without requiring central counterparties. Based on blockchain analysis, the attacker was believed to have exchanged a large portion of the Ether for Bitcoin (BTC) on the platform.
This self-fulfilling activity that drew billions of dollars (211% ROI) of transaction fees for the protocol (IOU, USDT, and USDC) showed how permissionless infrastructure of fungible decentralized liquidity can be harnessed for illicit high volumes. An estimate of activity‘s fee value (roughly $910,000) underscores its impact.
Even after THORChain, some of the funds were sent through another mixing protocol called Umbra, which is built using confidential technology. This additional layer of obfuscation made it more difficult for investigators and analytics companies to track the funds.
As of Thursday, the blockchain intelligence feeds from Arkham revealed that most of the funds in the attacker ‘s originally tagged wallet had been drained, hinting that its “money-laundering saga” was near-completion.
Signs of a Structured Exit Strategy
On-chain intelligence platforms like Arkham found the movement patterns to be characteristic of a hand-off, rather than a long-term, hold.
Instead of keeping the stolen money in identifiable wallets, which might cause a collaborative recovery effort against the attacker, the money was consolidated, transformed across assets, passed through numerous intermediate holding accounts, all within a very short period of time.
Referring to the rapid pace and the design of the transactions, the analysts pointed out that the transactions seem to be performed with the motive of “cashing out” rather than to manipulate the market or negotiate the ransom.
Limited Recovery Window: Arbitrum’s Frozen Funds
Not all of the stolen assets have been converted and are still frozen. The Arbitrum security council frozen about 30,766 ETH of the Binance fetch after the reentry.
These assets were moved into an intermediate wallet that is under governance control and not allowed to be moved at this time (without protocol level governance passing).
This frozen tranche is now the largest recoverable piece of the exploit, with the remaining stolen ETH having already passed through its own series of mixers and cross-chain swaps, further obscuring its origin.
How the Exploit Originated
The attack was against Kelp DAO, a restaking protocol utilizing liquid staking derivatives. Using flaws in its LayerZero-interopberable rsETH bridge system, the attacker could withdraw significant amounts of restaked Ether.
The stolen asset, rsETH, is an abstraction of staked ETH positions that are repurposed across decentralized finance structures to earn further yield. While efficient, this composability may lead to greater systemic risk if bridge infrastructure is compromised.
Broader Implications for DeFi Security
Such exploits further highlight the existing danger to cross-chain DeFi infrastructure, where the use of bridge protocols and restaking intersect. The swift washing of funds through DeFi protocols demonstrates both DeFi‘s strength and its Achilles heel: permissionless finance.
On one hand, DeFi‘s open source and perma-bridging liquidity models are unaffected by certain attack scenarios such as existing exploits on current stable coin bridges. Conversely, this openness is also conducive to being exploited as critical access points along illicit flow channels.
At the same time, the partial freeze of the Arbitrum court system reveals how the emergency powers are shifting into the hands of decentralized security councils. But such measures are more and more limited in their efficacy by how rapidly those who attack can put funds onto multiple chains and privacy layers.
Outlook
As much of the stolen value has now been spread across multiple chains via cross-chain swaps and privacy mixers, the investigation will likely narrow to the frozen funds under Arbitrum governance.
For the investigators, the case highlights a problem that is well known in decentralized finance once a large amount of stolen funds is swiftly bridged, swapped and anonymized, the opportunity for recovering the illicit gains is limited to hours or days instead of weeks.
