TL;DR:
- After the KelpDAO hack, attackers moved funds through ThorChain and acquired 442 BTC distributed across 400 addresses.
- The $211M inflow in BTC spot purchases pushed Bitcoin’s price above $78,000 within hours from its $75,000 floor.
- Funds were mixed with proceeds from the 2025 BTCTurk and Bybit hacks, and the exploit generated around $177M in bad debt within Aave.
The KelpDAO hack triggered a chain of on-chain movements that ended up directly impacting the price of Bitcoin. The attackers channeled the stolen funds through ThorChain, a permissionless exchange, where they converted them into BTC. The process generated a $211 million inflow in spot purchases that pushed Bitcoin’s price from $75,000 to above $78,000 within a matter of hours.
ThorChain recorded its highest daily fee volume so far this year as a direct consequence of the hackers’ activity. The network processed an average of 146 transactions per hour during the episode. By the time operations wrapped up, the attackers had distributed 442 BTC across 400 different addresses. The protocol refused to intervene, arguing that its design does not include censorship or fund-freezing mechanisms: the network operates with 95 nodes distributed globally and has no admin key, following Bitcoin’s model.
The Long Arm of North Korean Hackers
The on-chain investigation, tracked by Arkham Intelligence, identified several wallets used to move and convert ETH. The funds were ultimately mixed with proceeds from previous attacks, including the BTCTurk and Bybit hacks that took place in 2025, pointing to the TraderTraitor group and other operators linked to North Korea as those responsible for the laundering scheme.
The hackers executed the movements just three hours after Arbitrum froze approximately 25% of the funds that were still held on its network. Once on Bitcoin’s main chain, the coins can be tracked, but not blocked, effectively closing the laundering cycle.
The consequences of the hack spread across the entire DeFi ecosystem. Ethereum lost 17.73% of its total value locked, Hyperliquid recorded outflows of 17.68%, Arbitrum lost 13.65% of its liquidity, and Solana saw 6.14% of its funds flow out. The ecosystem’s composability amplified the damage: the attack left approximately $177 million in bad debt within the Aave protocol, while also potentially triggering secondary on-chain effects on other protocols that used those assets as collateral.
