Arbitrum freeze triggered fast ETH laundering, pushing THORChain quantity to $394M as attacker shifted funds into BTC.
On-chain knowledge is providing new readability on the Kelp DAO exploit, one of many largest current cross-chain bridge incidents. Motion of funds has accelerated following partial intervention by community authorities. Analysts monitoring the pockets exercise report a transparent laundering sample involving Ethereum-to-Bitcoin swaps. Exercise has additionally pushed an uncommon spike in cross-chain protocol volumes.
Kelp DAO Exploit Drives File THORChain Quantity and Charge Surge
Blockchain analytics agency EmberCN reported that the attacker behind the Kelp DAO exploit has already laundered 34,500 ETH, value roughly $80 million. Information reveals the exploiter initially moved about $175 million in ETH off Ethereum earlier than starting the conversion course of.
KelpDAO 黑客从昨天下午开始把 ETH 进行洗钱转移，到现在应该是洗走了 3.45 万枚 ETH ($8000 万)。
这些 ETH 大部分通过 @THORChain 跨链兑换成了 BTC，THORChain 也因此收获了不少的 “过路费”：
◎THORChain 过去 24 小时交易量暴增到 $3.6 亿，此前每日交易量平均只有 $2000 万。
◎THORChain 过去… https://t.co/YHNjV4jTGy pic.twitter.com/QRAAsYf6sb— 余烬 (@EmberCN) April 22, 2026
A key set off seems linked to intervention from the Arbitrum Safety Council, which froze 30,766 ETH tied to the exploit. That motion possible pushed the attacker to rapidly relocate remaining funds.
A lot of the stolen ETH was swapped for Bitcoin by way of THORChain, a decentralized, non-custodial trade community. The protocol processed round $394 million in swap quantity inside 24 hours, producing roughly $456,000 in charges. Typical each day quantity ranges between $10 million and $35 million, indicating a pointy deviation.
THORChain Stands Agency on Neutrality Amid Lazarus Hyperlinks to Exploit
Hyperlinks to previous incidents have raised considerations. THORChain has beforehand been utilized by the Lazarus Group, recognized for laundering stolen crypto property. LayerZero steered that the identical group could also be answerable for the Kelp DAO exploit.
Criticism has adopted THORChain’s refusal to dam suspicious transactions. The protocol maintains a strict impartial stance, arguing its design mirrors Bitcoin’s permissionless construction.
In line with its crew, no central authority or admin key exists to freeze funds, leaving enforcement totally to community code and node operators. Ongoing fund actions proceed to be monitored as investigators assess the complete scope of the breach.