The KelpDAO attacker has converted 75,700 stolen Ether (ETH), worth roughly $175 million, into Bitcoin (BTC) in about 36 hours.
KelpDAO Exploiter Moves Funds
On-chain analyst EmberCN first flagged the swap sprint in a post on X this week.
The attacker routed nearly all of the stolen ETH through THORChain, a permissionless cross-chain liquidity protocol, and exited into Bitcoin.
Those swaps generated about $800 million in trading volume and $910,000 in protocol fees for THORChain over the period, per EmberCN. Smaller batches passed through Umbra Cash, the stealth-payment privacy tool, which has since taken its hosted frontend offline and placed it in maintenance mode.
The rush followed an earlier move by Arbitrum's Security Council, which froze 30,766 ETH linked to the attacker, cutting off roughly $71 million.
Also Read: Ethereum Nears $2,450 Showdown As Bulls And Bears Split On Next Move
Aave Fallout Widens
Security researchers say the Bitcoin endpoint makes recovery harder, because BTC sits outside Ethereum-level governance tools.
LayerZero Labs has attributed the original $292 million bridge breach to North Korea's Lazarus Group.
The fallout keeps spreading through DeFi. EmberCN noted that Aave's total deposits have dropped from $45.8 billion to roughly $29.6 billion, a $16.2 billion outflow since the rsETH incident.
Aave founder Stani Kulechov confirmed this week that roughly $70 million of attacker-linked ETH has been recovered, though the protocol is still managing an estimated $196 million in bad debt from the exploit, and its native token has fallen roughly 16% since the attack began.
Read Next: TRON Connects $85B USDT Network To LI.FI In Cross-Chain DeFi Push