# KelpDAO Hacker Moving Funds: Attacker Transfers $175M to New Addresses

Source: https://info.arkm.com/research/kelpdao-hacker-moving-funds-attacker-transfers-175-41m-to-new-addresses

## Summary

The suspected Lazarus Group hackers behind the $292 million Kelp DAO hack have begun moving stolen funds, transferring 76K ETH (worth $175 million) to new addresses on-chain. The article says the transfers suggest the start of a laundering operation, following containment efforts on Layer 2 in which Arbitrum's Security Council froze around $71 million of stolen ETH. On-chain data also shows funds routed through the privacy protocol Umbra and cross-chain swaps to Bitcoin via THORChain, though these amounts are only a fraction of the total haul.

## Article

‍

The suspected Lazarus Group hackers behind the $292 million Kelp DAO hack are on the move, transferring 76K ETH (worth $175M) on-chain to new addresses.

The stolen funds have been sent to the following new addresses - click on each of them to explore each address on Arkham Intel.

(Note: This is a developing story, and the funds may have been moved again since this article was published.)

0xF9802c5EB6b972Ba686aFa7CA615910Ea8310b85

0xD4B87bAB0ee142182f7F6DA030AeFe3E7f171530

0x62c72510016732333e68177d388a8111643FC64E

This shift of capital suggests the beginning of a laundering operation by the hackers. The move follows recent containment efforts on Layer 2, with Arbitrum’s Security Council successfully freezing around $71 million worth of stolen ETH linked to the attack.

You can explore the frozen ETH on Arbitrum at this address:

0x0000000000000000000000000000000000000DA0

Now that a big chunk of the stolen funds have been frozen, the attacker is actively attempting to bridge the remaining funds into more difficult-to-track territory before further intervention.

Additionally, on-chain data also shows the stolen crypto being routed through the privacy protocol Umbra, as well as cross-chain swaps to the Bitcoin network via THORChain.

‍

‍

The initial exploit, which unlocked 116,500 rsETH (roughly 18% of the circulating supply) via a forged message on LayerZero, has been linked heavily to North Korea's Lazarus Group. Lazarus Group has also been linked with the other high-profile hack this month: Drift Protocol.

While the amounts successfully bridged through Umbra and THORChain are only a fraction of the overall haul, these new addresses signal that the attackers are executing an exit strategy rather than sitting on the proceeds.

View the laundering process in real-time on Arkham Intel using the KelpDAO custom entity here.

KelpDAO Attacker

Information provided herein is for general educational purposes only and is not intended to constitute investment or other advice on financial products. Such information is not, and should not be read as, an offer or recommendation to buy or sell or a solicitation of an offer or recommendation to buy or sell any particular digital asset or to use any particular investment strategy. Arkham makes no representations as to the accuracy, completeness, timeliness, suitability, or validity of any information on this website and will not be liable for any errors, omissions, or delays in this information or any losses, injuries, or damages arising from its display or use. Digital assets, including stablecoins and NFTs, are subject to market volatility, involve a high degree of risk, can lose value, and can even become worthless; additionally, digital assets are not covered by insurance against potential losses and are not subject to FDIC or SIPC protections. Historical returns are not indicative of future returns.