The hacker behind the devastating $293 million Kelp DAO exploit has successfully laundered nearly all of the unfrozen stolen funds, moving approximately $220 million in just six weeks, according to comprehensive onchain data and blockchain analysis.
Data from blockchain intelligence provider Arkham reveals that the wallet tagged as belonging to the Kelp DAO hacker has laundered the vast majority of the illicitly obtained assets, leaving a mere $1.7 million still traceable within the address. The malicious actor originally drained 116,500 Kelp DAO restaked Ether tokens, known as rsETH, on April 18. This massive single breach single-handedly pushed the total amount of capital lost to cryptocurrency hacks across the entire industry to an alarming $630 million for the month of April alone, making it one of the most destructive periods for decentralized finance security in recent memory.
According to detailed insights shared by onchain analyst Specter, the hacker executed a sophisticated two-layered laundering strategy to obscure the trail of the stolen capital. First, the funds were bridged across chains into Bitcoin utilizing the crypto mixing service Wasabi. Following this cross-chain obfuscation, the assets were routed back to the Ethereum network before being systematically withdrawn and deposited through the privacy-enhancing mixing protocol Tornado Cash.
Security experts warn that this complex and thorough laundering process will significantly reduce, if not entirely eliminate, the chances of recovering the remaining unfrozen funds, leaving victims and protocol administrators with limited avenues for retrieval.
Despite the successful laundering of the unconstrained assets, authorities and protocol stakeholders have managed to intercept a portion of the stolen capital. An additional $71 million connected to the Kelp DAO exploit was swiftly frozen by the Arbitrum Security Council on April 21. Prior to this, a formal governance proposal alongside a United States court order had approved the transfer of these frozen funds into an Aave-controlled multi-signature wallet to facilitate the ongoing rsETH recovery and remediation efforts. Legal proceedings concerning the ownership claims tied to these frozen funds continue to move forward, with a scheduled court hearing in New York handling the competing claims, court documents show.
This latest development unfolds just a week after Kelp DAO officially announced that it had successfully restored its restaked Ether token supply. The milestone was achieved as the culmination of a rigorous five-week recovery initiative, following the successful transmission of the final tranche of 20,373.7 rsETH tokens back to the LayerZero smart contract. This specific contract is tasked with the critical functions of locking, minting, burning, and releasing rsETH during cross-chain asset transfers.
Crypto Exploits Recede in May, But DeFi Security Anxiety Persists
Cryptocurrency hacks experienced a dramatic drop during the month of May, providing a momentary reprieve for the market, though the sharp decline has done little to soothe lingering anxieties regarding the fundamental security of the decentralized finance ecosystem.
Total financial losses resulting from cryptocurrency exploits plummeted to $68.3 million in May. According to data compiled by blockchain security platform CertiK, this figure represents a staggering 90% decline compared to the astronomical losses recorded in April. A breakdown of the May security incidents indicates that approximately $2.6 million of the total losses stemmed from targeted phishing attacks, while a modest $9.4 million was successfully recovered or voluntarily returned by exploiters.
Nevertheless, the profound shockwaves generated by the $293 million Kelp DAO exploit continue to reverberate throughout the decentralized finance sector, catalyzing a broader industry-wide reevaluation of risk management, infrastructure dependencies, and the reliability of oracle providers.
In the immediate aftermath of the security breach, several prominent platforms acted swiftly to fortify their technological stacks. Within three weeks of the incident, Bitcoin DeFi platform Solv Protocol and liquidity protocol Tydro both initiated migrations to Chainlink’s Cross-Chain Interoperability Protocol, commonly known as CCIP, in a concerted effort to onboard a more robust and secure oracle and cross-chain provider.
Kelp DAO itself undertook a significant infrastructure overhaul, migrating its flagship rsETH token natively to Chainlink CCIP. This decisive move marked a definitive break from its former LayerZero-powered bridge setup, with the project publicly attributing the root cause of the exploit to inherent vulnerabilities within its prior cross-chain architecture.
Conversely, the dispute over the technical responsibility for the breach saw competing narratives emerge from infrastructure providers. LayerZero released a public statement on April 20 asserting that the exploit was not the result of a flaw in its core protocol, but rather stemmed from a critical single point of failure within Kelp DAO’s specific implementation. According to LayerZero, the protocol had relied on a single Decentralized Verifier Network as its sole verified path for cross-chain communication, ignoring explicit prior warnings and best-practice configurations designed to prevent such vulnerabilities.
