KelpDAO Hacker Moved 75,701 ETH via THORChain Into BTC

A reported KelpDAO exploiter has moved 75,701 ETH, worth approximately $175 million, into BTC using THORChain and other cross-chain routes, according to on-chain evidence and a related Arbitrum Security Council emergency action.

How the Reported $175M ETH-to-BTC Move Unfolded

The reported movement involved 75,701 ETH being converted into Bitcoin through multiple channels. THORChain, a decentralized cross-chain liquidity protocol, was identified as a primary routing mechanism, though the headline and underlying evidence indicate other conversion paths were also used.

The story is classified as a security event spanning both the Ethereum and Bitcoin networks. The scale of the reported transfer, roughly $175 million at the time of movement, places it among the larger exploit-linked fund flows tracked in recent months, comparable in magnitude to cases like the alleged $400K Polymarket insider trading case in terms of enforcement attention, though far larger in dollar terms.

What the On-Chain Evidence Trail Shows

Several blockchain explorer records appear linked to the reported movement. An Etherscan transaction record shows activity tied to the event, while a corresponding Arbiscan transaction suggests the exploit had an Arbitrum-layer component.

ON-CHAIN DATA

The Arbitrum Security Council posted an emergency action thread that appears connected to the incident, suggesting protocol-level response measures were initiated.

It is important to note that the verification status of these connections remains partial. The available evidence links these transactions and addresses to the reported exploit, but the full laundering path from ETH through THORChain and other routes into BTC has not been conclusively mapped in publicly confirmed analysis. The confidence level in the underlying research is low, meaning readers should treat the routing details as reported rather than fully proven.

Why the BTC Conversion Matters

Converting a large ETH position into BTC through decentralized cross-chain protocols like THORChain is a notable tactical choice. Unlike centralized exchanges, decentralized routing avoids KYC checkpoints and makes asset freezes significantly harder to execute, a pattern that has drawn increasing scrutiny as cross-chain bridge volume grows.

The shift from ETH to BTC also moves the funds onto a network with a different privacy and traceability profile. While Bitcoin transactions are publicly visible, the lack of smart contract complexity can simplify obfuscation through mixing. This mirrors a broader trend in which exploit-linked funds are increasingly routed through decentralized infrastructure, a dynamic that has prompted calls from over 100 crypto firms for clearer regulatory frameworks.

No confirmed market reaction data tied to this specific movement was available in the research for this report. Bitcoin and Ethereum spot prices showed no verified impact attributable to the transfer.

What remains unresolved: whether the full conversion path will be independently confirmed by on-chain analytics firms, whether any portion of the funds can be frozen through protocol-level actions like the Arbitrum Security Council's emergency measures, and whether official statements from KelpDAO or THORChain governance will provide further clarity. Institutional responses to large-scale exploits, including how protocols coordinate with entities that hold Bitcoin reserves like Metaplanet's recent 8 billion yen bond raise for BTC, continue to shape how the industry handles post-exploit fund tracing.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.