Hackers behind the KelpDAO exploit have begun laundering an estimated $4.2 million in stolen cryptocurrency through decentralized mixers and cross-chain bridges, according to on-chain data from multiple blockchain analytics firms.
Market Context
The KelpDAO exploit, which occurred on April 18, drained approximately $12.4 million from the protocol's liquidity pools across Ethereum and Arbitrum networks. The attack exploited a vulnerability in the protocol's rebalancing mechanism, allowing the attacker to manipulate price feeds and drain reserves. This incident adds to a growing list of DeFi hacks in 2026, with total protocol losses exceeding $2.1 billion year-to-date.
Analysis
On-chain investigators at Elliptic and Nansen have traced the stolen funds through multiple wallets. Initial movement showed the hackers splitting assets across five wallets, each receiving roughly $2.5 million in USDC and wrapped tokens. Within 48 hours, the attackers began funneling funds through Tornado Cash, the Ethereum mixer that has processed over $15 billion in transaction volume since its 2019 launch.
Smart money trackers note the attackers employed a layered approach, first bridging assets to Bitcoin via RenVM before converting to Ethereum-based tokens. This cross-chain shuffling complicates recovery efforts, though Chainalysis researchers indicate approximately $1.8 million remains in identifiable wallets that could potentially be frozen through exchange coordination.
The KelpDAO team has offered a 10% bounty for return of funds and engaged with law enforcement agencies including the FBI's Virtual Asset Unit. However, past DeFi exploit recovery rates remain below 15%, according to blockchain forensics firm CipherTrace.
Key Numbers
- $12.4 million total stolen from KelpDAO protocol
- $4.2 million currently being laundered through mixers
- $1.8 million still in identifiable wallets
- 10% bounty offered for fund recovery
- $2.1 billion in DeFi protocol losses year-to-date 2026
What to Watch
The KelpDAO governance token, KELP, has declined 34% since the exploit, trading at $0.42 as of press time. The protocol's team is scheduled to release a post-mortem report by April 25, which may detail compensation plans for affected liquidity providers. Investigators will monitor wallet addresses 0x8a2f...3d91 and 0x7b4c...1e82 for any further movement or potential exchange deposits that could trigger freezes.
On-chain watchers also note the hackers may attempt to bridge remaining funds through Bitcoin-based privacy protocols, potentially complicating tracing efforts further. The DeFi community continues to debate protocol security standards in light of this latest exploit, with several governance proposals emerging around mandatory audits and insurance pools.