Kelp DAO Hacker Launders Nearly All $220M Stolen Funds — Recovery Hopes Dim
By John Nada·Jun 1, 2026·5 min read
Kelp DAO recovers some funds post-hack, but nearly $220M laundered, dimming recovery hopes and underscoring DeFi security challenges.
In crypto's wild west, the Kelp DAO heist stands as both a testament to vulnerabilities and a masterclass in elusiveness. On one hand, the Decentralized Autonomous Organization's recovery efforts have restored some semblance of order, sending the final tranche of restaked Ether to its rightful smart contract. On the other, the hacker behind the $293 million exploit has nearly perfected the art of digital evasion, laundering close to $220 million of the loot in a scant six weeks, according to onchain analysts and Arkham data.
The audacious laundering scheme employed a two-step process, bridging stolen funds to Bitcoin using Wasabi, a crypto mixer known for its anonymity, before boomeranging back to Ethereum and dispersing through Tornado Cash. This calculated disassembly significantly reduces any remaining hope of asset recovery, as highlighted by blockchain data provider Arkham. With only $1.7 million left traceable, the window for restitution narrows dramatically.
Conversely, Kelp DAO hasn't been idle. In a bid to bolster security, the organization migrated its restaked ETH token to Chainlink's Cross-Chain Interoperability Protocol (CCIP), distancing itself from the previous LayerZero-powered setup. LayerZero, for its part, pointed to a single point of failure in Kelp DAO's implementation, noting that the exploit was avoidable.
This juxtaposition of meticulous theft and proactive defense underscores a glaring truth: despite a near 90% drop in crypto hacks in May, exemplified by the reduced $68.3 million loss, as reported by security platform CertiK, the DeFi landscape remains fraught with peril. The Kelp DAO incident isn't just a blip; it's a clarion call for heightened security measures across decentralized finance.
While Kelp DAO's methodical recovery and transition to more secure protocols reflect a commitment to fortifying their ecosystem, the hacker's near-flawless execution casts a long shadow. As legal proceedings continue over the frozen $71 million, the industry watches closely. The impending court hearing in New York could render decisions crucial for future restitution efforts. Yet, as the funds slip further into obscurity, the onus shifts, marking a pivotal moment for broader DeFi security protocols.
The Kelp DAO exploit has been a significant event in the world of cryptocurrencies, affecting both the perception and the reality of security within decentralized finance ecosystems. The reconnaissance into the hack reveals a sophisticated approach, where the hacker managed to drain a staggering 116,500 Kelp DAO restaked ETH (rsETH) on April 18. This incident contributed to the cumulative total of $630 million stolen from crypto hacks in April, highlighting the magnitude of the breach.
The hacker's strategy was not just about the initial theft but also involved a complex laundering process. By bridging the stolen funds to Bitcoin through Wasabi, a well-known crypto mixer, the hacker capitalized on the platform's capability to obscure transaction trails. Wasabi's reputation for providing anonymity in crypto transactions made it a tool of choice for the hacker, allowing them to temporarily hide the digital trail of the stolen assets.
Once the stolen assets were anonymized, they were returned to the Ethereum network, where Tornado Cash, another mixing protocol, was utilized. Tornado Cash adds another layer of obfuscation, effectively scattering the trail of transactions, making it challenging for investigators to trace the funds. This dual-layered laundering process not only showcases the hacker's technical prowess but also reveals the vulnerabilities within the ecosystem that can be exploited for nefarious purposes.
Despite these challenges, Kelp DAO has been actively working to recover and secure its ecosystem. The migration of its rsETH token to Chainlink CCIP is a strategic move to enhance security. Chainlink's Cross-Chain Interoperability Protocol offers a robust alternative to the previous LayerZero setup, which was identified as having a single point of failure. LayerZero had previously warned against the configuration that Kelp DAO used, which relied on a single LayerZero DVN as the only verified path. This oversight in security configuration was a critical factor in the exploit, serving as a lesson for other DeFi platforms.
The broader implications of the Kelp DAO hack extend to the entire DeFi industry. Despite a notable decrease in crypto hacks in May—down to $68.3 million from the previous month's losses—the incident has prompted DeFi protocols to reassess their security measures. The hack has served as a catalyst for other platforms, such as Bitcoin DeFi platform Solv Protocol and liquidity protocol Tydro, to migrate to more secure oracle providers like Chainlink CCIP. These migrations underscore a growing recognition within the industry that robust security measures are paramount to safeguarding digital assets.
Legal proceedings surrounding the Kelp DAO hack continue to unfold, with a focus on the frozen $71 million. Arbitrum's Security Council played a pivotal role in freezing these funds on April 21, following a governance proposal and a US court order that approved the transfer of the frozen assets to an Aave-controlled multi-signature wallet. This wallet is part of the rsETH recovery effort, demonstrating the coordinated approach being taken to address the aftermath of the hack.
The upcoming court hearing in New York is expected to be a significant event, as it will address the ownership claims tied to the frozen funds. The legal outcomes of this hearing could have far-reaching implications for restitution efforts and the broader DeFi security landscape. As the industry grapples with the complexities of recovering from such a substantial hack, the lessons learned are likely to influence future security protocols and governance models.
The Kelp DAO exploit serves as a stark reminder of the importance of vigilant security practices in the rapidly evolving DeFi space. The incident has illuminated the potential weaknesses in cross-chain setups and the critical need for diversified and robust security configurations. As DeFi platforms continue to innovate and expand, the emphasis on security must remain at the forefront, ensuring that the digital assets of users are protected against increasingly sophisticated threats.