KelpDAO hacker launders stolen ETH through Arbitrum and Tron

The attacker behind KelpDAO's nearly $300 million exploit is now moving the stolen funds through a multi-chain route designed to obscure onchain traces. Blockchain security firm PeckShield reported that the cybercriminal bridged the stolen ETH from Ethereum to Arbitrum via Across Protocol, swapped the assets into the stablecoin USDT0, then transferred the proceeds to Tron using LayerZero. The laundering comes after what analysts describe as 2026's largest DeFi hack, which occurred on April 18. Roughly 116,500 rsETH (about $292 million) was taken from KelpDAO's cross-chain bridge, which relies on LayerZero. Investigators said the attacker spoofed messages to route funds into wallets under their control. Researchers said the incident was not caused by a conventional smart-contract vulnerability. Instead, the breach stemmed from compromised RPC (Remote Procedure Call) infrastructure hosted by LayerZero. A single-validator (DVN) configuration created a single point of failure, and coordinated DDoS attacks reportedly enabled malicious validation. That, in turn, allowed the attacker to forge transactions that appeared legitimate to the system. On April 20, Kelp said its top priority was protecting users and preventing broader contagion across DeFi, adding it was working with ecosystem partners to assess impact, coordinate support, and pursue remediation options. LayerZero also issued a statement suggesting the DPRK-linked Lazarus Group may be responsible, specifically referencing TraderTraitor. The breach has already rippled through the market. DeFi's total value locked (TLV) fell by more than $13 billion immediately after the incident. Major protocols including Aave froze certain markets or reduced exposure, while lending venues faced liquidity pressure and rising bad-debt risk. Analysts said the attacker also used stolen assets as collateral to borrow additional funds, contributing to a $7 billion drop in Aave's TLV. Losses from hacks and exploits in 2026 have now exceeded $750 million. Related: KelpDAO Attacker Moves 75,700 ETH Worth $175M in Three Transactions Disclaimer: This article is for informational and educational purposes only and does not constitute financial advice. Coin Edition is not responsible for any losses resulting from the use of content, products, or services referenced. Readers should exercise caution before taking any action related to the company.