Kelp DAO Attacker Launders $80 Million in ETH as THORChain Volume Surges

• The Kelp DAO exploiter has reportedly laundered 34,500 ETH, worth roughly $80 million, according to onchain analyst EmberCN.
• Most of the stolen ETH appears to have been swapped into Bitcoin through THORChain, driving the protocol’s daily volume far above normal levels.

The Kelp DAO attacker appears to be moving quickly again, this time through cross-chain routes that are much harder to interrupt once the funds are in motion.

According to onchain analyst EmberCN, the exploiter has laundered around 34,500 ETH, worth roughly $80 million, after moving about $175 million in ETH off Ethereum on Tuesday. The timing suggests that once part of the stolen haul was frozen, the attacker accelerated efforts to move the rest.

The Arbitrum freeze may have triggered the next move

EmberCN had previously said that the Arbitrum Security Council’s decision to freeze 30,766 ETH likely forced the exploiter to act more aggressively with the remaining funds. That detail matters because it shows how partial intervention can sometimes change attacker behavior rather than stop it outright.

Once a portion of the funds was locked, the rest appears to have been rerouted rapidly through systems designed for non-custodial liquidity rather than compliance controls.

According to EmberCN’s translated post, most of the ETH was swapped into BTC via THORChain, the cross-chain protocol that allows users to move between native assets without relying on a centralized intermediary. For the attacker, that is an obvious advantage. For the wider market, it is another reminder that liquidity rails built for openness can also become efficient escape routes during exploit cleanup.

THORChain volumes jumped far above normal

The protocol’s own data appears to reflect that shift. According to THORChain’s dashboard, the network processed about $394 million in swap volume over the past 24 hours, generating roughly $456,000 in fee revenue.

That is far above its usual daily activity, which EmberCN said generally falls between $10 million and $35 million.

In other words, the laundering activity was large enough to visibly distort the protocol’s operating profile.

For Kelp DAO and the investigators tracking the exploit, that leaves a difficult reality. Freezing funds can still matter, and in this case it plainly did. But once the attacker manages to push remaining assets into high-liquidity, cross-chain infrastructure, the chase becomes much harder, much faster.