The attacker behind the roughly $290 million Kelp DAO exploit has begun moving large amounts of stolen funds, likely in an attempt to launder them.
According to Arkham, a wallet linked to the exploit transferred about 75,700 Ether—worth roughly $175 million—across three transactions on Tuesday. This included a 25,000 ETH transfer to a newly created address, along with additional transfers of 50,700 ETH and 0.7 ETH to another wallet.
Blockchain investigator ZachXBT reported on Telegram that funds tied to the exploit have started moving through THORChain and Umbra, highlighting three THORChain transactions totaling around $1.5 million and a separate $78,000 transfer via Umbra.
The original attack took place on Saturday, when roughly 116,500 rsETH—valued between $290 million and $293 million—was drained from a LayerZero-powered bridge. LayerZero later said the protocol’s 1/1 decentralized verifier network (DVN) configuration created a single point of failure, as it relied on just one verifier path for cross-chain message validation—something it had previously advised against.
Fallout spreads across DeFi
The fund movements came just hours after Arbitrum revealed that its 12-member Security Council had taken emergency action to freeze 30,766 ETH linked to the exploit, transferring the assets into an intermediary wallet controlled through governance.
The exploit has also impacted other DeFi platforms, including Aave, where the attacker used stolen assets as collateral to borrow funds. Early estimates put the shortfall at around $195 million, though Aave’s April 20 report outlined two possible outcomes: roughly $123.7 million in bad debt under one scenario and about $230.1 million under another.
The recent transfers indicate the attacker has begun routing funds through non-custodial protocols, which can make tracing and recovery more difficult. For example, THORChain does not require traditional Know Your Customer (KYC) checks.
A similar pattern was seen during the Bybit hack, where attackers converted about 83% of stolen Ether into Bitcoin. According to Ben Zhou, around 72% of those funds moved through THORChain, though roughly 77% remained traceable at the time.
Aave adjusts protocol settings
On Tuesday, Aave said it had unfrozen Wrapped Ether reserves on its Ethereum Core V3 market, allowing users to supply WETH once again. However, WETH reserves across other deployments—including Ethereum Prime, Arbitrum, Base, Mantle and Linea—remain frozen.
Meanwhile, tightening liquidity conditions pushed borrowing costs sharply higher on Aave, with rates for Tether jumping from around 3% to 14%—their highest level since December 2024. The spike was noted by Julio Moreno in a Monday post on X.
Concerns about broader contagion have also triggered major outflows from the protocol. Data from DeFiLlama shows Aave’s total value locked (TVL) has dropped by roughly $10 billion since the exploit, falling to about $16.4 billion as of Tuesday.
