KelpDAO Stolen Funds Enter Money Laundering Phase: Some of the funds have been cross-chain transferred to the Bitcoin network via THORChain and have been split across over 400 addresses

BlockBeats News, April 22, According to on-chain analyst Specter (@SpecterAnalyst), the North Korean hacker group TraderTraitor began laundering the stolen funds from KelpDAO early this morning Beijing time, just three hours after the Arbitrum Council froze 30,700 ETH (approximately $71 million). The attacker split the remaining funds into three wallets, holding about 25,000 ETH (approximately $57.6 million), 25,700 ETH (approximately $59.2 million), and 25,000 ETH (approximately $57.9 million) respectively. The third wallet immediately started the laundering process, leaving only about 3,800 ETH (approximately $8 million) remaining.

The funds were mainly bridged to the Bitcoin network through the THORChain, with about 99% of the funds flowing through that protocol, causing THORChain's daily trading volume to soar to $211 million, more than 10 times its 30-day average, generating approximately $189,000 in fees. During this money laundering process, the funds were also mixed with the proceeds from the BTC Turk (2025) and Bybit (2025) hack events, totaling about 442 BTC (approximately $33 million) traced on the Bitcoin network, involving over 400 addresses in the entire laundering process.