KelpDAO Hackers Initiate Laundering of $290 Million in Stolen Assets

Attackers responsible for a $290 million exploit of KelpDAO have begun the 'layering' phase of money laundering, according to data from Arkham and on-chain analyst ZachXBT. The movement of funds suggests a coordinated effort to obscure the trail of stolen assets through cross-chain bridges and privacy protocols. These tactics are frequently employed by sophisticated state-sponsored actors, including the North Korean-linked Lazarus Group, which has previously utilized similar protocols to obfuscate illicit gains. By routing funds through various venues, the attackers aim to disperse the capital before it can be blacklisted or frozen by centralized exchanges. On Tuesday, the wallet controlling the exploit proceeds executed two significant transfers on the Ethereum blockchain totaling $175 million, consisting of individual transfers of $117 million and $58 million. Additionally, approximately $1.5 million was bridged from Ethereum to Bitcoin via Thorchain, while $78,000 was routed through the privacy tool Umbra. The breach has triggered widespread negative sentiment across the decentralized finance (DeFi) ecosystem, with market participants expressing concerns over potential contagion spreading to other blockchains. The urgency for the attackers to move funds may have been accelerated by Arbitrum's decision on Monday to freeze $71 million in linked ether, limiting the exploiters' immediate liquidity.