Arbitrum freeze triggered rapid ETH laundering, pushing THORChain volume to $394M as attacker shifted funds into BTC.
On-chain data is offering new clarity on the Kelp DAO exploit, one of the largest recent cross-chain bridge incidents. Movement of funds has accelerated following partial intervention by network authorities. Analysts tracking the wallet activity report a clear laundering pattern involving Ethereum-to-Bitcoin swaps. Activity has also driven an unusual spike in cross-chain protocol volumes.
Kelp DAO Exploit Drives Record THORChain Volume and Fee Surge
Blockchain analytics firm EmberCN reported that the attacker behind the Kelp DAO exploit has already laundered 34,500 ETH, worth roughly $80 million. Data shows the exploiter initially moved about $175 million in ETH off Ethereum before beginning the conversion process.
KelpDAO 黑客从昨天下午开始把 ETH 进行洗钱转移，到现在应该是洗走了 3.45 万枚 ETH ($8000 万)。
这些 ETH 大部分通过 @THORChain 跨链兑换成了 BTC，THORChain 也因此收获了不少的 “过路费”：
◎THORChain 过去 24 小时交易量暴增到 $3.6 亿，此前每日交易量平均只有 $2000 万。
◎THORChain 过去… https://t.co/YHNjV4jTGy pic.twitter.com/QRAAsYf6sb— 余烬 (@EmberCN) April 22, 2026
A key trigger appears linked to intervention from the Arbitrum Security Council, which froze 30,766 ETH tied to the exploit. That action likely pushed the attacker to quickly relocate remaining funds.
Most of the stolen ETH was swapped for Bitcoin via THORChain, a decentralized, non-custodial exchange network. The protocol processed around $394 million in swap volume within 24 hours, generating approximately $456,000 in fees. Typical daily volume ranges between $10 million and $35 million, indicating a sharp deviation.
THORChain Stands Firm on Neutrality Amid Lazarus Links to Exploit
Links to past incidents have raised concerns. THORChain has previously been used by the Lazarus Group, known for laundering stolen crypto assets. LayerZero suggested that the same group may be responsible for the Kelp DAO exploit.
Criticism has followed THORChain’s refusal to block suspicious transactions. The protocol maintains a strict neutral stance, arguing its design mirrors Bitcoin’s permissionless structure.
According to its team, no central authority or admin key exists to freeze funds, leaving enforcement entirely to network code and node operators. Ongoing fund movements continue to be monitored as investigators assess the full scope of the breach.