Attackers behind KelpDAO breach help lift Bitcoin

The effects of the KelpDAO attackers go deeper, this time affecting even BTC trading. Some of the funds from the exploit were moved through ThorChain and swapped into BTC. 

The KelpDAO hack has wider effects on the crypto ecosystem, as the hackers attempt to swap and mix their holdings. The latest move showed the funds moved through ThorChain and were swapped into BTC. 

The hack brought another $211M in spot buying to BTC, and was one of the factors that sent BTC above $78,000. BTC rallied within hours, launching from its lower range of $75,000. For now, BTC rejected the $78,000 level, but the hackers indicated that the market would react to an inflow of buyers. 

KelpDAO boosted ThorChain volume

ThorChain has been one of the platforms widely used to swap funds in a totally permissionless environment. In previous hacks reported by Cryptopolitan, ThorChain’s team has not cooperated to intercept the funds during bridging or other visible operations. The chain has not even set up a mechanism to intercept funds, as all transactions depend on 95 permissionless nodes. 

THORChain was modelled after Bitcoin, to be permissionless and censorship resistant.

There’s no single person or entity in control of the protocol. There’s no admin key. There’s no 2-of-3 multisig. Currently, there’s 95 nodes spread globally that control the network. For the… pic.twitter.com/Za2Obrh9dO

— THORChain (@THORChain) April 21, 2026

During previous incidents, ThorChain has allowed funds to be mixed and disguised, citing its main goal of not interfering. Yet after Web3 hacks accelerated in the past month, all participants reconsidered the need to freeze funds and diminish the losses. 

The KelpDAO attackers moved funds just three hours after Arbitrum froze around 25% of their haul on the network. One of the identified wallets was used to move and swap ETH, based on Arkham Intelligence tracking.

The hacker’s activity boosted ThorChain activity to 10 times its normal daily volume, ending up with 442 BTC moved to 400 addresses. On-chain researchers have pinpointed some of the key addresses with the biggest holdings. The coins can be mixed further or swapped into privacy coins to disguise their origin. 

Following the attack, ThorChain recorded its highest daily fee volume for the year to date. The network helped the hackers perform on average 146 transactions an hour.

KelpDAO attackers moved funds to the Bitcoin chain

Additional on-chain research shows the funds from the KelpDAO hack were mixed with proceeds from other incidents, including the BTC Turk and Bybit attacks from 2025. ThorChain also refused to assist with the Bybit hack, though other ecosystem participants were ready to freeze funds where possible. 

The latest laundering episode shows the TraderTraitor group and other DPRK hackers were an increasing threat to Web3. The ability to launder funds is adding more risk, as hackers have evolved their techniques for faster and untraceable laundering. After using ThorChain, the hackers moved all BTC on the main network, where the coins could be traced, but not frozen. 

The KelpDAO exploit also affected other networks, creating significant outflows. Ethereum lost 17.73% of its total value locked, 17.68% flowed out of Hyperliquid, Arbitrum lost 13.65% of its liquidity, and Solana saw 6.14% in outflows. The lost funds may have wide repercussions on Web3, due to the composability of DeFi lending and reusing some coins for collateral on other protocols. The final estimate is that the hack led to around 177M in bad debt on Aave.

The smartest crypto minds already read our newsletter. Want in? Join them.