onchain analyst – with subsequent confirmation from the blockchain investigator ZackXBTwho flagged specific laundry trails via Telegram – determined that the wallet associated with Exploitation of seaweed DAO Actively routing approximately $80 million of ETH through THORChain, a permissionless cross-chain liquidity protocol, with ZachXBT identifying early movements of approximately $1.5 million across three THORChain transactions and an additional $78,000 routed via Umbra, the money laundering activity has pushed THORChain’s 24-hour swap volume to $394 million – nearly 11 times its typical daily volume Which is less than $35 million – recently. April 2026.
We suspect that this is not a story about the mechanics of an exploiter’s money laundering, but rather a structural signal about THORChain’s continued role as the preferred exit infrastructure for large-scale DeFi theft, and the practical limits of protocol-level containment once stolen assets clear the initial on-chain defenses and reach impermissible places across the chain.
🚨NOW: KELP DAO EXPLOITER STEALS $80 MILLION USD VIA THORCHAIN
The Kelp DAO attacker laundered nearly $80 million in ETH, primarily through THORChain, after moving $175 million in Ethereum funds on Tuesday after Arbitrum froze 30,766 ETH of the stolen funds. pic.twitter.com/kguaN5h1r8
— Currency Bureau (@coinbureau) April 22, 2026
discovers: The Best Cryptocurrencies You Can Buy Right Now – Updated CoinSpeaker Guide
THORChain Kelp DAO routing, confirmed wallet flows, and what the on-chain registry determines
The mechanism works as follows: Following the April 19, 2026 hack in which an attacker drained approximately 116,500 rsETH from Kelp DAO’s LayerZero-powered rsETH bridge converter — funding the initial gas fee via Tornado Cash before swapping the stolen assets back into ETH — Arkham Intelligence tracked the exploiter transferring 75,700 ETH, equivalent to roughly $175 million, across three separate transactions. In April, it was carried out on November 22, 2026, including the transfer of 25,000 ETH to a new address and 50,700 ETH to another, marking the beginning of a wider spread of money laundering.
From those intermediary wallets, funds were routed through THORChain’s native asset swap infrastructure, which carries out cross-chain transfers — primarily ETH to Bitcoin — without custodial intermediaries, without KYC checkpoints, and without any mechanism for node operators to freeze or reverse individual transactions once initiated.
ZachXBT’s tracking indicates funds were passed through Tornado Cash prior to cross-chain forks, with a portion of it later arriving into the Bitcoin network via THORChain and an additional hash via Umbra, a privacy protocol built on Ethereum. It is necessary to note the state of knowledge of many details here: the exact total confirmed for THORChain cleared versus still in transfer has not been verified at the time of publication; The specific wallet addresses and transaction hashes associated with the $80 million have not been independently confirmed by the second forensic firm beyond ZachXBT’s Telegram disclosures; The full range of on-chain destination addresses on the Bitcoin side is not publicly enumerated.
What has been confirmed: The anomalous spike in THORChain volume to $394 million over a 24-hour period is consistent with a high volume directional flow rather than organic market activity, and Arbitrum separately froze 30,766 ETH linked to the exploiter — part of the broader stolen corpus — which was documented in Arbitrum’s published governance action.
explores: Best Ethereum Wallets 2026 – CoinSpeaker Updated Guide
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to provide accurate and timely information but should not be considered financial or investment advice. Since market conditions can change rapidly, we encourage you to verify the information yourself and consult with a professional before making any decisions based on this content.
Daniel Francis is a technical writer and Web3 educator specializing in macroeconomics and DeFi mechanics. A crypto native since 2017, Daniel brings his background in cross-chain analytics to author evidence-based reports and detailed guides. It is certified by the Blockchain Council and is dedicated to providing “information gain” that cuts through the market noise to find blockchain’s real-world utility.
