According to The Defiant, follow-up to the Kelp DAO bridge exploit reveals that approximately $220 million in unfrozen funds have been almost entirely laundered by the attacker. On-chain data from Arkham Intelligence shows that the original attacker’s wallet now holds only about $1.7 million, with the rest moved through a series of privacy tools within a short time frame.
Hacker Background and Attack Trail
The group behind the attack has clear ties to North Korea and previously executed a $292 million bridge exploit against LayerZero in April. A report released by LayerZero on May 18 officially attributed the incident to the North Korean TraderTraitor organization. This links two major bridge attacks totaling over $500 million to the same source, underscoring the persistent threat this group poses to cross-chain infrastructure.
Laundering via Privacy Tools
Arkham Intelligence mapped the money flow: the hacker first used THORChain for cross-chain swaps, then routed funds through Wasabi, Tornado Cash for mixing, and ultimately leveraged Umbra and similar tools to obscure the final destination. The procedure was tightly interlocked, making routine on-chain monitoring extremely difficult, and leaving less than $1.7 million directly traceable to the attacker.
Recoverable Funds and Ecosystem Recovery
The only untouched portion is the approximately $71 million in ETH that the Arbitrum Security Council froze on April 20. In response, Kelp rapidly adjusted by migrating to Chainlink CCIP and launching the DeFi United initiative, successfully recovering about 116,000 rsETH. Meanwhile, Aave’s safety module absorbed around $190 million in bad debt, limiting the direct impact on the protocol.
This laundering operation exposes the security weaknesses of bridges when faced with sophisticated attackers, especially when combined with privacy tools that drastically increase the difficulty of tracking. While Kelp has strengthened its defenses through technical upgrades, the $220 million that was washed is largely unrecoverable, leaving only the $71 million frozen by Arbitrum as partial compensation for victims.