The stolen assets from KelpDAO have entered a large-scale laundering phase. On-chain analyst Specter's monitoring shows that the North Korean hacker group TraderTraitor began operations in the early hours of April 22 Beijing time, just three hours after the Arbitrum Council froze approximately 30.7 million ETH. The attacker dispersed the remaining funds into three separate wallets, holding about 25,000 ETH, 25,700 ETH, and 25,000 ETH respectively. The third wallet has already initiated the money laundering process, and its ETH balance has now dropped to around 3,800.
The laundering process heavily relies on the cross-chain protocol THORChain. Approximately 99% of the stolen funds were bridged to the Bitcoin network via this protocol, causing THORChain's daily trading volume to surge to $211 million, more than ten times its 30-day average, and generating around $189,000 in fees.
Within the laundering chain, some funds were also mixed with illicit proceeds from the BTC Turk and Bybit hacking incidents. Currently, approximately 442 BTC of related funds have been tracked on the Bitcoin network, and the entire money laundering operation has utilized over 400 addresses.