Kelp DAO Exploiter Launders $80M ETH via THORChain
An onchain analyst – with subsequent corroboration from blockchain investigator ZachXBT, who flagged specific laundering paths via Telegram – has determined that the wallet associated with the Kelp DAO exploit is actively routing approximately $80 million worth of ETH through THORChain, a permissionless cross-chain liquidity protocol, with ZachXBT identifying early movements of roughly $1.5 million across three THORChain transactions and an additional $78,000 routed via Umbra, and the laundering activity driving THORChain’s 24-hour swap volume to $394 million – approximately eleven times its typical daily volume of under $35 million – as of late April 2026.
We suspect this is less a story about one exploiter’s laundering mechanics and more a structural signal about THORChain’s persistent role as the preferred exit infrastructure for large-scale DeFi theft, and the practical limits of protocol-level containment once stolen assets clear initial on-chain defenses and reach permissionless cross-chain venues.
🚨JUST NOW: KELP DAO EXPLOITER LAUNDERS $80M IN ETH VIA THORCHAIN
Kelp DAO attacker has laundered roughly $80MILLION in ETH, primarily through THORChain, after moving $175M funds off Ethereum on Tuesday after Arbitrum froze 30,766 ETH in stolen funds. pic.twitter.com/kguaN5h1r8
— Coin Bureau (@coinbureau) April 22, 2026
DISCOVER: Best crypto to buy right now – CoinSpeaker’s updated guide
THORChain Kelp DAO Routing, Confirmed Wallet Flows, and What the On-Chain Record Establishes
The mechanism functions as follows: following the April 19, 2026 exploit in which the attacker drained approximately 116,500 rsETH from Kelp DAO’s LayerZero-powered rsETH bridge adapter – funding initial gas fees via Tornado Cash before swapping stolen assets back into ETH – Arkham Intelligence tracked the exploiter moving 75,700 ETH, equivalent to roughly $175 million, across three discrete transactions on April 22, 2026, including a transfer of 25,000 ETH to one new address and 50,700 ETH to another, marking the beginning of a broader laundering dispersal.
From those intermediate wallets, funds have been routed through THORChain’s native asset swap infrastructure, which executes cross-chain conversions – primarily ETH to Bitcoin – without custodial intermediaries, without KYC checkpoints, and without any mechanism for node operators to freeze or reverse individual transactions once initiated.
ZachXBT’s tracing indicates the funds passed through Tornado Cash before the cross-chain splits, with some portion subsequently reaching the Bitcoin network via THORChain and additional fragmentation through Umbra, a privacy protocol built on Ethereum. It is necessary to flag the epistemic status of several details here: the precise total confirmed to have cleared THORChain versus still in transit is unverified at time of publication; the specific wallet addresses and transaction hashes tied to the $80 million figure have not been independently confirmed by a second forensic firm beyond ZachXBT’s Telegram disclosures; and the full scope of cross-chain destination addresses on the Bitcoin side has not been publicly enumerated.
What is confirmed: THORChain’s anomalous volume spike to $394 million over a 24-hour window is consistent with a large-volume directional flow rather than organic market activity, and Arbitrum separately froze 30,766 ETH linked to the exploiter – a portion of the broader stolen pool – which is documented in Arbitrum’s published governance action.
EXPLORE: Best Ethereum wallets for 2026 – CoinSpeaker’s updated guide
next