KelpDAO's stolen funds have entered the laundering phase, with some funds being cross-chained to the Bitcoin network via THORChain, utilizing over 400 addresses

According to on-chain analyst Specter (@SpecterAnalyst), the North Korean hacker group TraderTraitor began laundering stolen funds from KelpDAO early this morning Beijing time, just three hours after the Arbitrum Council froze 30.7 ETH (approximately $71 million).

The attackers split the remaining funds into three wallets, holding approximately 25,000 ETH (about $57.6 million), 25,700 ETH (about $59.2 million), and 25,000 ETH (about $57.9 million), with the third wallet immediately starting the laundering process, currently holding about 3,800 ETH (approximately $8 million). The funds are primarily being bridged to the Bitcoin network via THORChain, with about 99% of the funds flowing through this protocol, causing THORChain's trading volume to surge to $211 million that day, more than ten times its 30-day average, generating approximately $189,000 in fees.

During this laundering process, the funds were also mixed with illicit proceeds from the BTC Turk (2025) and Bybit (2025) hacking incidents, with related funds currently tracked on the Bitcoin network totaling approximately 442 BTC (about $33 million), and the entire laundering process has utilized over 400 addresses.