KelpDAO Hacker Estimated to Have Laundered 76,000 Ether Using THORChain, Umbra

Most of the Ether stolen in the KelpDAO hack, about 76,000 tokens, is estimated to have already been laundered.

Cointelegraph reported on April 23 that the KelpDAO hacker had laundered most of the roughly 75,700 Ether stolen last week from April 21 through April 23. The funds successfully moved were worth about $175 million.

The hacker used THORChain and privacy protocol Umbra to launder the funds. Blockchain analytics firm EmberCN wrote in a post on X on April 23 that the attacker mainly swapped Ether for Bitcoin through THORChain. The activity generated about $910,000 in fee revenue for THORChain.

As the laundering has progressed, the amount of recoverable funds has fallen. Assets routed through THORChain are harder to trace, reducing the chances of recovery. Blockchain analytics firm Arkham said the hackers were no longer just holding the stolen funds and had begun executing a full exit strategy.

Some of the funds have been frozen. The Arbitrum Security Council recently froze 30,766 Ether tied to the hack and moved the assets to a separate wallet. Access to those funds will require a governance process.

KelpDAO said it is moving quickly to develop a solution. In a post on X on April 23, the protocol said it was making progress on an appropriate remedy and was focused on protecting users and strengthening the protocol.