A breach of KelpDAO triggered a massive on-chain BTC buying spree. Attackers converted stolen funds into Bitcoin through ThorChain, executing a spot purchase of $211 million that briefly pushed BTC above $78,000. The surge failed to hold; prices retreated sharply. Analysts linked the spike to the attackers' concentrated buying aimed at securing liquidity.
ThorChain Records Annual High in Volume
ThorChain's fully permissionless, decentralized design makes it a preferred tool for hackers. In this incident, attackers moved roughly 25% of assets on the Arbitrum network to other chains about three hours before authorities attempted to freeze them. Meanwhile, analytics firm Arkham Intelligence tracked suspect wallets: a total of 442 BTC were dispersed across 400 addresses. ThorChain processed ten times its daily average transaction volume, setting a yearly record for fees. Attackers executed an average of 146 transactions per hour, creating significant protocol activity.
Post-Hack Cleanup and Cross-Chain Fallout
Some assets from the KelpDAO breach were mixed with funds linked to earlier hacks of BTC Türk and Bybit from 2025. Although ThorChain and similar protocols did not intervene, parts of the broader ecosystem attempted to freeze assets where possible. Investigators reported that attackers deliberately moved funds to the main Bitcoin network and split them across multiple addresses, nullifying freezing attempts. The TraderTraitor group, allegedly connected to North Korea, has used similar tactics in prior operations.
The fallout extended to Ethereum, Hyperliquid, Arbitrum, and Solana. Ethereum's TVL dropped 17.73%, Hyperliquid fell 17.68%, Arbitrum dropped 13.65%, and Solana declined 6.14%. Analysts estimated that Aave accumulated an additional $177 million in bad debt. These developments renewed concerns about dual risks in DeFi: a security breach in one ecosystem can trigger capital outflows and losses across interconnected protocols due to cross-chain liquidity flows. Attackers' sophisticated mixing tactics make monitoring and preventive responses extremely difficult.