KelpDAO Hackers Launder $211M Through ThorChain into BTC

Attackers who stole funds from KelpDAO routed about $211 million through ThorChain, converted the money into roughly 442 BTC and distributed those coins to about 400 Bitcoin addresses, according to on-chain tracking data. The flows coincided with a brief move of Bitcoin above $78,000.

On-chain trackers show the attackers moved stolen ETH into ThorChain, where it was swapped for Bitcoin and dispersed across hundreds of addresses. The transactions began hours after Arbitrum froze about 25% of the stolen funds on its network. Arkham Intelligence flagged at least one wallet involved in the swapping operations.

ThorChain’s official account posted: “There’s no single person or entity in control of the protocol. There’s no admin key. There’s no 2-of-3 multisig.” The protocol runs on a distributed set of nodes without a centralized admin key or a built-in asset-freeze mechanism, so individual transfers on the chain cannot be stopped or reversed by a single party.

The laundering sequence raised ThorChain activity to about ten times its normal daily volume. On-chain researchers calculated the protocol handled the operations at an average pace of about 146 transactions per hour. ThorChain recorded its largest daily fee revenue so far this year during the period of elevated activity.

After the ETH-to-BTC swaps on ThorChain, the coins were moved onto the Bitcoin mainnet. Those funds remain traceable on-chain but are not subject to the centralized freeze controls that exist on some other networks. Analysts identified several addresses holding large portions of the moved BTC and reported that some of the coins were blended with proceeds from prior incidents, including breaches tied to BTC Turk and Bybit in 2025.

On-chain researchers warned the funds could be mixed further or converted into privacy-focused tokens to obscure their origin. The conversion into Bitcoin amounted to about $211 million in spot buying, a factor that contributed to a short-lived rise in Bitcoin’s price from roughly $75,000 to above $78,000 before prices pulled back.

The exploit affected liquidity across multiple networks. Ethereum’s total value locked fell by about 17.73%. Hyperliquid recorded about 17.68% in outflows, Arbitrum saw around 13.65% leave its pools, and Solana experienced about 6.14% in outflows. The incident also generated roughly $177 million in bad debt on Aave, according to on-chain debt calculations.

Security researchers continue to monitor the identified addresses and on-chain flows as they track further movement or conversion of the laundered funds.