Kelp DAO Hacker Has Laundered Nearly All $220M in Unfrozen Funds, Closing the Recovery Window - "The Defiant"

You've reached your guest reading limit.

By continuing, you agree to our Terms and Privacy Policy.

The Kelp DAO bridge hacker has laundered nearly all of the roughly $220 million in unfrozen funds left from April's $292 million LayerZero exploit, with on-chain analysts at Arkham Intelligence tracking only about $1.7 million still parked in the original exploiter wallet.

The drain through privacy rails ends the practical chance of asset-by-asset recovery on the unfrozen portion of the haul, leaving only the $71 million in ether frozen by Arbitrum's Security Council on April 20 as the materially recoverable slice. The protocol-level resolution — Kelp's migration of rsETH bridging to Chainlink CCIP and its DeFi United plan that restored roughly 116,000 rsETH to users — happened in parallel; what is closing now is the asset-tracing arc.

LayerZero's May 18 incident report, co-prepared with Mandiant, CrowdStrike and zeroShadow, attributed the attack to DPRK actor TraderTraitor — also tracked as UNC4899 and part of the broader Lazarus Group — the same crew tied to the parallel $285 million Drift heist the same week.