KelpDAO Exploiter: From Ether to Bitcoin, a Tale of Digital Derring-Do

Well, bless my stars and garters! Just as the Arbitrum Security Council thought they’d lassoed themselves a tidy sum of 30,766 ether from the KelpDAO fiasco, the scoundrel behind it all up and skedaddled with a cool 75,701 ETH-that’s a whopping $175 million in cold, hard digital cash-straight to the Ethereum mainnet. And what does this rascal do next? Why, starts funneling it all into Bitcoin, of course!

Key Takeaways (or, as I like to call ’em, the CliffsNotes for the digitally distracted):

  • After Arbitrum froze 30,766 ETH ($71M), the KelpDAO rapscallion moved 75,701 ETH ($175M) to the Ethereum mainnet. Talk about a quick getaway!
  • Peckshield, those digital bloodhounds, confirmed our culprit is shuttling the loot to bitcoin via Thorchain, Umbra Cash, and Chainflip. Fancy footwork, indeed.
  • The Lazarus Group’s KelpDAO heist adds to over $600M in DeFi losses in three weeks. Total value locked? Down 25%. Ouch.

Arbitrum Freeze Triggers a Digital Dash

On April 18, the KelpDAO scallywag made off with a staggering $292 million from the liquid restaking protocol’s Layerzero-powered bridge. The biggest DeFi exploit of 2026, they say. Well, I say it’s just another day in the Wild West of the web.

Earlier today, the Arbitrum Security Council-those digital sheriffs-froze 30,766 ETH ($71.15 million) held by our miscreant on Arbitrum One. Dragonfly partner Haseeb Qureshi confirmed they used a privileged system-level transaction to snatch it back, bypassing the scoundrel’s wallet controls. Slick, ain’t it?

KelpDAO tipped their hat to the council, saying they’d worked hand-in-glove with ’em and other bigwigs for two days to pull off the intervention. The freeze recovered about 29% of the ether the rapscallion had hoarded across chains. Not too shabby, but not a full victory either.

Attacker Empties Address, Heads for the Bitcoin Hills

No sooner had the Arbitrum freeze gone through than our digital desperado moved all 75,701 ETH ($175 million) to Ethereum and started laundering it. Peckshield flagged the route, noting the scoundrel bridged the loot in small batches to bitcoin via Thorchain, Umbra Cash, and Chainflip. Decentralized protocols, they call ’em. I call ’em getaway cars.

Image source: X

Peckshield also noted that less than 0.768 ETH for gas remains in the original address. Wallet’s as empty as a politician’s promise.

Layerzero pointed the finger at North Korea’s Lazarus Group and their Trader Traitor subunit, citing onchain tactics that match past state-sponsored shenanigans. Wu Blockchain data shows the KelpDAO heist has pushed total DeFi losses past $600 million in three weeks. Total value locked? Down 25% to $82.4 billion. That’s a lot of digital tears.

Read More

2026-04-21 13:28