The KelpDAO hacker has accelerated its laundering operation. An on-chain analyst highlighted that 75,700 stolen Ethereum (ETH), worth about $175 million, has now been “almost entirely” swapped for Bitcoin (BTC).
The conversion followed Arbitrum’s Security Council freezing attacker-linked ETH earlier this week, which pushed the hacker to accelerate fund movements.
KelpDAO Exploiter Converts Stolen ETH to Bitcoin
According to on-chain analyst EmberCN, the KelpDAO hacker has moved the stolen funds at a blistering pace, offloading assets in roughly 1.5 days. The attacker relied heavily on THORChain to cross-chain swap ETH into BTC.
“The hacker’s activity also brought THORChain $800 million in trading volume along with $910,000 in platform fee revenue,” the analyst wrote.
THORChain was modelled after Bitcoin, to be permissionless and censorship resistant.
There’s no single person or entity in control of the protocol. There’s no admin key. There’s no 2-of-3 multisig. Currently, there’s 95 nodes spread globally that control the network. For the… pic.twitter.com/Za2Obrh9dO
The rapid exit follows an earlier setback for the attacker. EmberCN noted that the hacker lost access to the ETH held on Arbitrum. Afterward, he began laundering the ETH.
Several small transfers were made through Umbra Cash, the privacy-focused stealth payment protocol. Umbra has since pulled its hosted frontend offline and placed it in maintenance mode.
In a statement, the team said access to the hosted frontend would be restored only once doing so would not interfere with ongoing recovery efforts.
The fallout has continued to hit the DeFi space. In a separate post, EmberCN highlighted that Aave’s total deposit volume fell from $45.8 billion to about $29.6 billion. The cumulative outflow reached $16.2 billion after the rsETH incident.
