The attacker behind the $290 million KelpDAO exploit is actively laundering approximately $175 million in Ether after Arbitrum’s Security Council froze over $71 million of the stolen funds on April 21. On-chain data shows the exploiter moving quickly to obfuscate the remaining assets, which were drained from KelpDAO’s LayerZero-powered rsETH bridge on April 18.
"The @KelpDAO exploiter has begun laundering stolen funds (~$176M)," blockchain security firm PeckShield said in a post on X. The firm noted that the attacker started bridging small batches of funds from Ethereum to Bitcoin via decentralized protocols including THORChain, Umbra Cash, and Chainflip.
The laundering effort involves approximately 75,701 ETH, which was consolidated before being routed to new addresses. This began hours after Arbitrum’s 12-member security council voted 9-to-3 to freeze 30,766 ETH held in a wallet on the Arbitrum One network. The frozen funds, now in a wallet accessible only via a future governance vote, represent about 29% of the total amount stolen in what is the largest decentralized finance exploit of 2026.
The incident highlights a growing debate over the balance between decentralization and security on Layer 2 networks, as the attacker races to launder the remaining funds before they can be similarly frozen. The fallout has already spread across DeFi on Ethereum, with lending protocol Aave facing bad debt that its team estimates could range from $123.7 million to $230.1 million after the exploiter used the stolen rsETH as collateral.
The exploit’s scale and sophistication have led some investigators to suggest the involvement of North Korea’s Lazarus Group, which has a history of using similar cross-chain laundering techniques. KelpDAO has publicly blamed the infrastructure of cross-chain messaging protocol LayerZero for the breach, citing a "single point of failure" in its verifier network setup, a configuration LayerZero claims it had advised against.
In response to the contagion, Aave has frozen Wrapped Ether (WETH) reserves on its Arbitrum, Base, Mantle, and Linea markets to prevent further losses. The total value locked on Aave has fallen by approximately $10 billion to $16.4 billion since the exploit, according to data from DefiLlama. The next steps for the $71 million in frozen funds on Arbitrum await a formal governance proposal and vote from its token holders.
This article is for informational purposes only and does not constitute investment advice.
