Kelp DAO Exploiter Launders ~$80M via THORChain: ETH-to-BTC Swap Cascade Signals Ongoing DeFi Contagion Risk

Event Summary

According to Arkham Intelligence and ZachXBT, the Kelp DAO attacker — preliminarily linked to North Korea's Lazarus Group — moved approximately 75,700 ETH (~$175M) across three transactions on April 22, 2026, following the April 19 exploit that drained ~116,500 rsETH (~$290M) via a single-verification flaw in Kelp's LayerZero bridge adapter. Arbitrum's security council had frozen 30,766 ETH (~$70.9M) in an emergency governance action; the laundering began roughly three hours after that freeze.

As reported by CoinSpeaker and AMBCrypto, approximately $80M was laundered through THORChain via ETH→BTC cross-chain swaps, dispersing 442 BTC across 400 wallets. THORChain volume spiked to an estimated $394M–$540M against a normal baseline below $35M, generating ~$660K in protocol fees. THORChain has maintained a no-KYC, no-freeze neutrality stance throughout. This mirrors the Bybit $1.4B hack methodology, where ~72% of funds transited THORChain.

Leverage Impact Analysis

The confirmed ETH laundering flow creates a specific liquidation environment for perpetual futures traders on ETH. With ETH priced at $2,350.75 (+1.67% 24h per live data), short-term resilience masks a structural overhang: ~44,700 ETH remains unlaundered and could hit markets in further tranches.

Consider a 100x long ETH perpetual opened at $2,350: a 1% adverse move to ~$2,327 triggers liquidation — well within range if a second laundering wave hits spot markets. At 500x leverage, the liquidation buffer narrows to ~0.2%, meaning any large OTC or DEX sell pressure becomes an immediate threat. Conversely, short traders should note that ETH has so far absorbed the news with resilience; a squeeze above $2,400 on thin liquidity could rapidly liquidate high-leverage shorts.

For Arbitrum (ARB), currently trading at $0.1264 (–0.16%, 24h range $0.1235–$0.1321), the emergency freeze action is a double-edged narrative: governance competence vs. centralization concerns. High-leverage ARB longs (50x+) face liquidation near $0.1235 — the 24h low already tested — should DeFi sentiment deteriorate further.

Funding rates and open interest on ETH and ARB perpetuals should be monitored closely on CoinUnited.io for directional confirmation before entering leveraged positions.

Cross-Market Impact

The ETH→BTC swap routing has a constructive short-term effect on Bitcoin — 442 BTC absorbed across 400 addresses represents forced buy-side pressure, however dispersed. This is consistent with the crypto state-sponsored hacks playbook where stolen altcoin/ETH value flows into BTC as the deepest liquidity exit.

For crypto-proxy equities, Coinbase (COIN) and MicroStrategy (MSTR) face indirect headwinds: repeated high-profile DeFi exploits accelerate regulatory pressure on centralized exchanges and deepen the DeFi structural reset narrative. Broader DeFi confidence erosion also pressures stablecoin inflows — relevant to USDC velocity metrics.

This event reinforces the contested dynamics around self-custody and cross-chain infrastructure, where THORChain's neutrality simultaneously validates permissionless design and draws regulatory scrutiny. For traders tracking the 2026 Crypto Market Outlook, bridge security remains the sector's most acute structural risk.

Trading Considerations

Key levels: ETH support at $2,300 (psychological), resistance at $2,400. ARB support at the 24h low of $0.1235; a break lower opens a retest of $0.12. Watch for further wallet movements from the remaining unlaundered ETH tranche — on-chain alerts via Arkham or ZachXBT are the fastest confirmation signal.

Risk factors include a second laundering wave, regulatory response targeting THORChain (RUNE), and any contagion to LayerZero-adjacent protocols. Position sizing should reflect the unresolved $175M overhang.

Trade Arbitrum on CoinUnited.io

Trade ARB with up to 2000xx leverage → | Create Free Account