Kelp DAO hackers have basically completed the money laundering, with nearly all of the approximately $220 million in unfrozen funds flowing out of tracking range

In the April Kelp DAO cross-chain bridge attack, approximately $292 million in assets were stolen. Aside from about $71 million in ETH that has been frozen, the remaining approximately $220 million has mostly been laundered, and the attacker's original address now holds only about $1.7 million in assets.

On-chain analysis shows that the attacker has completed multiple rounds of cross-chain and mixing operations using privacy tools such as THORChain, Wasabi, Tornado Cash, and Umbra, making most of the funds untraceable. Investigative agencies have previously attributed this attack to the North Korean hacker organization Lazarus Group (TraderTraitor/UNC4899).

One day after the attack, the hacker split approximately 75,700 ETH (then worth about $175 million) into multiple new addresses and cross-chained to the Bitcoin network via THORChain, then used tools like Wasabi CoinJoin and Tornado Cash for mixing. During this period, the related fund flows pushed THORChain's daily trading volume to a peak of $394 million, more than ten times the normal level.

Currently, the only assets with a relatively high chance of recovery are approximately 30,766 ETH (about $71 million) frozen by the Arbitrum Security Council. However, this portion of assets has fallen into new legal disputes, as the U.S. District Court for the Southern District of New York has previously issued a restraining order to temporarily freeze the related funds, because some family members of North Korean terrorism victims are seeking to apply for the