DeFi exploiter launders $80M ETH via DEX

TLDR

A hacker from the recent Kelp DAO exploit has reportedly laundered about $80 million of Ether (ETH) through decentralized exchanges, mainly via THORChain.

1. The Kelp DAO exploiter drained roughly $290 million and has already pushed around $80 million in ETH through THORChain and other privacy tools.
2. Arbitrum governance froze about 30,766 ETH linked to the hack, but a much larger portion is being moved across chains, highlighting how hard it is to contain DeFi thefts.
3. The case reinforces cross-chain bridges and non-KYC DEXes as key choke points, and may drive stricter security configs and governance powers across DeFi.

Deep Dive

1. How The Laundering Worked

Kelp DAOs LayerZero-powered rsETH bridge was exploited for roughly $290 million, with about 116,500 rsETH drained and converted to ETH.

On-chain analysts report that the attacker has since laundered around $80 million in ETH, primarily through THORChain, a cross-chain DEX that lets users swap assets between chains without KYC or centralized custody. Reporting notes that this activity pushed THORChains 24 hour volume to several times its usual level, consistent with abnormal laundering flows rather than organic trading.

Funds reportedly moved from Ethereum through tools like Tornado Cash and Umbra into THORChain, then into Bitcoin and other ecosystems, fragmenting the trail across multiple addresses and chains.

2. What Was Contained And What Was Not

Arbitrums Security Council used emergency powers to freeze 30,766 ETH, around 71 million dollars, linked to the exploit, moving it into a governance controlled wallet and cutting the attacker off from that chunk.

However, news coverage and on-chain investigators estimate that roughly 75,700 ETH, about 175 million dollars, still left Ethereum mainnet for further laundering, with a significant portion routed through THORChain and other DEX or bridge infrastructure.

This partial containment shows both the upside and controversy of strong governance tools. They can stop some flows, but they also raise questions about decentralization when councils can freeze funds.

3. Broader Impact On DeFi And ETH

The Kelp DAO incident is described as the largest DeFi hack of 2026 so far, with reports of double digit billions withdrawn from DeFi platforms in the days after the exploit, and large outflows from Aave where rsETH was used as collateral.

Analysts and security firms increasingly link this attack to North Koreas Lazarus Group and point to a pattern of bridge exploits feeding cross-chain laundering pipelines that include THORChain, Tron based stablecoins, and privacy tools.

For ETH holders, the direct sell pressure from the exploiter is meaningful, but the bigger effect is sentiment. Institutional participants and cautious DeFi users may reduce exposure to protocols that rely on risky bridge or oracle setups.

Conclusion

The laundering of around $80 million in ETH through THORChain after the Kelp DAO exploit shows how quickly sophisticated attackers can convert a single bridge bug into multi chain, hard to trace flows. The partial freeze on Arbitrum proves that active governance can recover some assets, but most value still escaped, reinforcing cross-chain security and protocol configuration as critical risk factors for anyone exposed to DeFi.