The exploiter that drained $292 million from LayerZero-powered cross-chain bridge Kelp DAO has since laundered around $80 million worth of Ethereum (ETH), according to blockchain analysis provider EmberCN.

Citing onchain data, EmberCN wrote on X that the Kelp DAO attacker appears to have laundered 34,500 ETH since it moved roughly $175 million in ETH off of Ethereum on Tuesday. 

The onchain analyst previously wrote that Arbitrum Security Council's action to freeze a large portion of the stolen funds — 30,766 ETH — appears to have prompted the exploiter to move the rest of the funds.

"Most of the ETH was swapped into BTC via cross-chain exchange on THORChain," EmberCN wrote in a translated X post, saying that the non-custodial swap protocol has earned hefty fees as a result.

According to THORChain's data dashboard, the protocol saw a swap volume of $394 million in the past 24 hours, making around $456,000 in fee revenue. This significantly exceeds THORChain's usual volume, roughly between $10 million and $35 million.

THORChain has been previously used by North Korean hackers who stole over $1.5 billion from the Bybit crypto exchange, laundering ETH into BTC. LayerZero has said that North Korea's Lazarus Group was likely behind the Kelp DAO exploit.

While THORChain has received criticism for not blocking or freezing funds linked to North Korean hackers, it has maintained that it will continue to operate with a strict hands-off policy.

"THORChain was modelled after Bitcoin, to be permissionless and censorship resistant," the protocol wrote Tuesday. "There's no single person or entity in control of the protocol. There's no admin key.  There's no 2-of-3 multisig … THORChain is neutral because the code is neutral, and the nodes enforce it."