Kelp DAO hack, six months on: 75,700 ETH became 2,105 BTC in two days — and none of it has stopped moving

Kelp DAO issues rsETH, a token that represents restaked ether, and moved it between chains through a LayerZero bridge. According to LayerZero’s own account, attackers compromised its internal nodes and made its verifier approve a forged message, and the bridge on Ethereum released 116,500 rsETH that had never been locked anywhere. Kelp’s bridge relied on that single verifier. Kelp has since sued LayerZero.

The wallet that received the rsETH, 0x8B1b6c9A6DB1304000412dd21Ae6A70a82d60D3b, had been funded six and a half hours earlier with 0.098 ETH from Tornado Cash. Within six minutes of the drain it split the rsETH across seven wallets, which put it up as collateral on Aave, Compound and Euler and borrowed real ether against it. That is the trick of the whole theft: the rsETH was worthless, the borrowed ETH was not.

On 20 April the Arbitrum Security Council froze 30,766 ETH held by the attacker on Arbitrum. Everything below is the other part — the ether that was on Ethereum itself.

Five of the borrowing wallets sent their ether to one address, 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc: 75,700 ETH in all, the largest single piece 52,440.7 ETH from 0x1F4C1c2e610f089D6914c4448E6F21Cb0db3adeF. It sat there for almost three days.

At 07:39 UTC on 21 April — the morning after the Arbitrum freeze — the wallet emptied itself in two transactions, 25,000 ETH to 0xF9802c5EB6b972Ba686aFa7CA615910Ea8310b85 and 50,700 ETH to 0xABc82C8975c922E5aa836b4AFd36FAD4511A65b8. Half an hour later the first swap went through. From those two wallets the ether fanned out across 265 wallets, each feeding THORChain in pieces of a few dozen to a few hundred ETH.

THORChain swaps one chain’s coin for another’s without a custodian and without asking who is swapping. Its own records show 857 successful swaps from these wallets between 21 and 28 April, sending in 70,015 ETH. About 13,800 ETH of that came back as unfilled parts of large orders and was sent again, and separate attempts worth 14,400 ETH were refunded outright and retried — the wallets kept pushing until it went through.

It went through fast: 68,570 ETH on 21 and 22 April alone. What came out was 2,104.67 BTC, paid to 359 different bitcoin addresses.

About 5,100 ETH took other exits — a bridge to Polygon, CoW Protocol, the stealth-address tool Umbra, Across and others. We did not follow those.

Nowhere that stays still. We read all 359 payout addresses on 4 October 2026: every one is empty. They were emptied on the same two days the swaps happened, in 434 transactions that spread the coins across 1,159 further addresses — no mixer, just many small moves.

We then read the 300 largest of those next addresses, which took 94% of the money. All 300 are empty as well. One of them is a busy service wallet, and it received about 2 BTC; the rest are single-use addresses that passed the coins on.

That is the difference between this theft and most of the ones we track. The Coldcard thieves have left more than a thousand bitcoin on four addresses for two months; the Nostra attacker is still sitting on his. Here nothing was allowed to rest. Six months later there is no address to watch — only a path that keeps going.

It names no person. The attribution to the Lazarus Group is LayerZero’s and Chainalysis’s, not ours, and nothing we read confirms or contradicts it. The loss, the mechanism and the Arbitrum freeze are as reported by the parties involved. Our own readings are the wallet tree on Ethereum, THORChain’s swap records and the state of the bitcoin addresses on 4 October 2026. The tree was built by following ether out of the consolidation wallet; a wallet that received attacker ether from a third party would be missed, and about 5,100 ETH that left by other routes was not followed.