Kelp DAO Hacker Has Successfully Laundered Funds, with Approximately $220 million of Unfrozen Funds Almost Entirely Moved Out of Traceability

As of June 2, the April cross-chain bridge attack on Kelp DAO resulted in the theft of roughly $292 million in assets. Of that total, about $71 million in ETH has been frozen, while the remaining $220 million has been mostly laundered. The attacker’s original wallet now holds just around $1.7 million in assets. On-chain analysis indicates the hacker deployed privacy tools including THORChain, Wasabi, Tornado Cash, and Umbra to carry out multiple rounds of cross-chain swaps and coin mixing, leaving the majority of the stolen funds untraceable. Investigators previously identified the attack as the work of North Korean hacker group Lazarus Group (also known as TraderTraitor/UNC4899). The day after the breach, the attacker split roughly 75,700 ETH — worth approximately $175 million at the time — into several new addresses, bridged the funds to the Bitcoin network via THORChain, then mixed them using Wasabi CoinJoin and Tornado Cash. This activity briefly pushed THORChain’s daily transaction volume to $394 million, over 10 times its average normal level. The only stolen asset that currently has a viable recovery path is roughly 30,766 ETH — equal to about $71 million — frozen by the Arbitrum Security Council. But these funds are now caught up in a new legal battle: the U.S. Southern District of New York Federal Court has issued a temporary restraining order (TRO) to freeze the assets. The order comes as relatives of North Korean terrorism victims are pushing to seize the funds via legal action to enforce a compensation judgment.