Kelp DAO's $175M ETH Laundering via THORChain: Liquidation Risks and DeFi Contagion for Leveraged Traders

Event Summary

According to on-chain analysts including ZachXBT and blockchain security firms Peckshield, CertiK, Cyvers, and Arkham, the Kelp DAO exploiter — attributed to North Korea's Lazarus Group (TraderTraitor subunit) — drained 116,500 rsETH (~$292–300M) on April 18, 2026 at ~17:35 UTC by spoofing a LayerZero cross-chain message. After Arbitrum froze ~30,766 ETH ($71M, ~29% of funds) on April 21/22, the attacker rapidly moved the remaining 75,701 ETH (~$175M) to Ethereum mainnet, routing through THORChain primarily, alongside Umbra Cash and Chainflip, converting to Bitcoin in small batches. As reported by Arkham, the exploiter wallet now holds under 0.768 ETH. The stolen rsETH dumped onto Aave V3/V4 generated $177–236M in bad debt, prompting Aave to freeze markets and set LTV to 0%. Total DeFi TVL dropped ~25% to $82.4B — part of $600M+ in DeFi losses over three weeks.

Leverage Impact Analysis

This event creates two distinct leverage pressure vectors for ETH traders on CoinUnited.io perpetuals.

ETH Short Pressure: The 75,701 ETH distribution represents sustained sell-side flow. A trader holding a 100x long ETH perpetual entered pre-laundering faces amplified drawdown on each incremental dump batch. Even a 3–5% ETH price decline from laundering pressure translates to a 300–500% notional loss on a 100x position — triggering liquidation well before the move completes. Monitor funding rates on CoinUnited.io; negative funding (shorts paying longs) would signal market consensus has shifted bearish.

RUNE Volatility Spike: THORChain's RUNE is trading at $0.4770 (+12.95% in 24h, range $0.4510–$0.4777 per live data), reflecting volume surge from the laundering activity. A 200x long RUNE perpetual at $0.4770 faces liquidation with a move of just ~0.5% against the position (~$0.0024). Conversely, a 50x long opened near $0.45 support has ~2% buffer before liquidation. Given the self-custody & cross-chain infrastructure narrative, RUNE volume spikes may be transient rather than structural — extreme caution on holding high-leverage RUNE longs post-spike.

The DeFi structural reset context means funding rates across DeFi-adjacent tokens could remain elevated and volatile. Reduce position sizing on all restaking or cross-chain protocol tokens until Aave bad debt ($177–236M) is formally resolved.

Cross-Market Impact

ETH/BTC: ~$175M ETH-to-BTC conversion via THORChain creates mechanical BTC inflow support, but sentiment is net negative. The Bitcoin geopolitical payment rails narrative is complicated by tainted inflows linked to Lazarus Group — potentially triggering exchange-level screening.

Crypto Stocks: Coinbase Global (COIN) and Robinhood (HOOD) face risk-off pressure as DeFi panic reduces retail and institutional activity metrics. MicroStrategy (MSTR) correlation to BTC means any BTC sentiment deterioration flows through. This is consistent with the crypto state-sponsored hacks theme, which historically correlates with 5–15% drawdowns in crypto-adjacent equities.

Stablecoins/USDC: USDC flight-to-safety flows may increase as users exit DeFi protocols — monitor stablecoin dominance for confirmation. See our institutional stablecoins guide for context on stablecoin dynamics during DeFi stress.

Trading Considerations

Key levels to watch: RUNE at $0.4510 (24h low) acts as near-term support; a break below opens the $0.40 psychological level. ETH traders should monitor the $2,300–$2,400 zone as potential distribution resistance given whale sell pressure. The Aave DeFi lending situation ($177–236M bad debt) remains the primary systemic risk — resolution or escalation will determine whether DeFi TVL stabilizes at $82.4B or continues declining. North Korea's Lazarus attribution may also trigger regulatory responses, adding a second-order regulatory risk layer for DeFi assets.

Trade THORChain on CoinUnited.io

Trade RUNE with up to 2000xx leverage → | Create Free Account