KelpDAO hacker swaps 75,700 ETH for BTC as THORChain fees spike

Bitcoin and Ether prices held a tight range on April 23 as the KelpDAO hacker accelerated its cashout path. The attacker swapped about 75,700 ETH into bitcoin in roughly 36 hours, with THORChain handling most of the cross-chain flow. BTC changed hands near $78,114 while ETH traded around $2,343 at the time of reporting. 

KelpDAO hacker swaps 75,700 ETH to BTC in 36 hours

On-chain trackers flagged the move as a rapid rotation of stolen ETH into BTC. The KelpDAO hacker converted nearly all of the 75,700 ETH stash, valued near $175 million, into BTC over about a day and a half.

The flow followed the bridge drain that began on April 18, when KelpDAO lost about 116,500 rsETH worth roughly $292 million. LayerZero, whose messaging stack underpinned the affected bridge, said preliminary indicators pointed to a state-linked actor and described the root issue as a single-verifier configuration that approved cross-chain messages. 

The KelpDAO exploit also lands in a wider 2026 security cycle for DeFi. Earlier this month, Drift Protocol said attackers drained about $285 million in an operation that Chainalysis and TRM Labs tied to long-running social engineering and governance compromise patterns. 

THORChain volumes jump as cross chain swaps rack up fees

THORChain became the main routing layer for the KelpDAO hacker’s ETH-to-BTC conversion, according to multiple reports that tracked the swaps in real time.THORChain the primary venue for the cross-chain execution, with the activity generating about $800 million in swap volume and roughly $910,000 in protocol fees. 

The swap burst also pulled THORChain into the spotlight for its economic incentives. Fee revenue accrues to the protocol during periods of stress-driven flow, even when the underlying activity stems from an exploit. The KelpDAO hacker kept swaps on-chain, avoiding identity checks at centralized venues. 

For investigators, THORChain matters because it moves value across chains without a centralized exchange at the swap step. That does not stop tracing, but it reduces the number of points where a single compliance team can halt funds before they land on another network. 

Bitcoin rotation limits freezes after Arbitrum action

The KelpDAO hacker’s decision to rotate into Bitcoin arrived after Arbitrum’s Security Council froze a separate tranche of ETH linked to the exploit. Arbitrum said it executed an emergency action to secure 30,766 ETH—about $71 million—moving the funds into an intermediary wallet that now requires governance action to move. 

That sequence helps explain the incentive to leave Ethereum rails. Ethereum-side recovery can use contract controls, front-end blocks, and issuer actions such as token blacklists. Bitcoin does not offer a comparable base-layer freeze, so investigators usually center the endgame on off-ramps that can flag deposits and coordinate enforcement actions. 

Galaxy’s incident analysis described the response as a multi-system emergency, with actions across LayerZero, Arbitrum, and Aave reducing immediate spillover risk while value still found a route to another chain once the attacker rotated.

Aave containment measures face 196 million bad debt tally

The bridge drain became a lending-market stress test because the KelpDAO hacker used rsETH as collateral to borrow liquid assets. Aave froze rsETH and wrsETH markets and later expanded defensive actions as utilization climbed, according to an Aave governance incident report. 

The steps included in setting rsETH loan-to-value to zero included adjusting WETH rate models, and later freezing WETH in multiple markets to contain second-order stress. Stani Kulechov said Aave’s contracts were not exploited and framed the event as an rsETH incident requiring risk controls rather than contract fixes. 

As reported the exploit left roughly $196 million in Aave-specific bad debt and coincided with a sharp drop in Aave’s TVL as depositors pulled liquidity. AAVE trades at $91.62, down 1.86 percent on the day, and sits near its $91.51 intraday low after topping out at $95.77 earlier in the session. 

Risk appetite faded in altcoins as BTC dominance rose to 60.07 percent and the Altcoin Season Index hit 34. Near term, bulls need a hold above $90 for a bounce toward $93–$96, or risk $86. A USDC rate-hike proposal is the key catalyst that could pull liquidity back into Aave

Where investigators look next as BTC addresses proliferate

With the ETH-to-BTC rotation largely complete, monitoring shifts to Bitcoin deposit clusters tied to the KelpDAO hacker and any attempt to cash out through identifiable venues. Analytics firms watch for consolidation events, peel chains, and the first deposits into exchanges with robust compliance programs, since that moment often creates the clearest recovery leverage. 

Chainalysis-linked reporting in late 2025 put North Korea’s crypto theft haul around $2.02 billion for the year. In the KelpDAO case, LayerZero said it had “preliminary confidence” in state-linked attribution, which can raise scrutiny across exchanges and brokers as new address clusters appear.

No public statement has confirmed a definitive, consolidated list of flagged Bitcoin addresses tied to the KelpDAO hacker cashout, leaving responders to coordinate across analytics firms, exchanges, and law enforcement as new clusters surface.