Kelp DAO hackers complete money laundering of $220M, with most funds untraceable.

Huo Xing Finance reports that, as of June 2, of the approximately $292 million stolen in the April Kelp DAO bridge attack, all funds except for the approximately $71 million in ETH that have been frozen have largely been laundered, leaving only about $1.7 million in assets remaining in the attacker’s original address. On-chain analysis shows the attacker has conducted multiple cross-chain and mixing operations using privacy tools such as THORChain, Wasabi, Tornado Cash, and Umbra, rendering most of the funds untraceable. The investigation previously attributed this attack to the North Korean hacking group Lazarus Group (TraderTraitor/UNC4899). One day after the attack, the hackers split approximately 75,700 ETH (worth about $175 million at the time) across multiple new addresses and cross-chained them to the Bitcoin network via THORChain, followed by mixing through Wasabi CoinJoin, Tornado Cash, and other tools. During this period, related fund flows temporarily pushed THORChain’s daily trading volume to $394 million—more than ten times its normal level. The only assets still with a high likelihood of recovery are the approximately 30,766 ETH (about $71 million) frozen by the Arbitrum Security Council. However, these funds are now entangled in new legal disputes: the U.S. District Court for the Southern District of New York previously issued a restraining order requiring the temporary freeze of these funds, as family members of some North Korean terrorism victims are seeking to pursue legal action to seize the assets in order to enforce compensation judgments.