TechFlow News, April 22: According to on-chain analyst Specter (@SpecterAnalyst), the North Korean hacker group TraderTraitor began laundering stolen funds from KelpDAO at approximately 3 a.m. Beijing Time today—just three hours after the Arbitrum Council froze 30.7 ETH (approximately $71 million). The attackers split the remaining funds across three wallets, holding roughly 25,000 ETH (~$57.6 million), 25,700 ETH (~$59.2 million), and 25,000 ETH (~$57.9 million), respectively. The third wallet immediately initiated laundering operations and now holds only approximately 3,800 ETH (~$8 million).
The funds were primarily bridged to the Bitcoin network via THORChain, with roughly 99% of the illicit funds flowing through this protocol. As a result, THORChain’s daily trading volume surged to $211 million—over ten times its 30-day average—generating approximately $189,000 in fees. During this laundering process, the funds were also mixed with illicit proceeds from the BTC Turk (2025) and Bybit (2025) hacks. To date, approximately 442 BTC (~$33 million) linked to these incidents have been traced on the Bitcoin network, and over 400 addresses have been utilized throughout the entire laundering operation.
