KelpDAO Stolen Funds Enter Laundering Phase: Some Funds Cross-Chain to Bitcoin Network, Over 400 Addresses Touched

**On-chain analyst Specter (@SpecterAnalyst) reports that North Korean hacker group TraderTraitor launched a money laundering operation for funds stolen from KelpDAO early this morning Beijing time—just three hours after the Arbitrum Council froze 37,000 ETH (≈$71 million).** The attacker split the remaining funds into three wallets, holding roughly 25,000 ETH (≈$57.6M), 25,700 ETH (≈$59.2M), and 25,000 ETH (≈$57.9M, respectively). The third wallet immediately began laundering, with only ~3,800 ETH (≈$8M) remaining as of now. Funds were primarily bridged to the Bitcoin network via THORChain: ~99% flowed through the protocol, pushing THORChain’s daily transaction volume to $2.11 billion—over 10x its 30-day average—and generating ~$189,000 in fees. During laundering, the funds were mixed with proceeds from the 2025 BTC Turk and 2025 Bybit hacks, with ~442 BTC (≈$33M) traced on the Bitcoin network. The entire process involved over 400 addresses.