Kelp DAO Hacker Moves $175M to Bitcoin: Why It Can’t Be Frozen

by

Kelp DAO Hacker Moves Funds to <a href="https://investment-policy.com/btc-usd/">Bitcoin</a> and It Cannot Be Frozen: Here’s Why

Following a significant cryptocurrency hack, it’s common for hackers to quickly move the stolen funds to many new wallets. They then use various decentralized platforms to transfer the money across different blockchains, often converting it to Bitcoin or sending it to privacy tools like Tornado Cash. This makes it much more difficult to track or freeze the funds, and that’s precisely what happened in the recent 2026 exploit.

Starting around April 21st, the hacker responsible for the KelpDAO breach transferred about $175 million worth of Ethereum (75,700 ETH) to new digital wallets within a 36-hour period.

Most of the money was later moved around using decentralized exchanges, especially THORChain, which directly swapped Ethereum (ETH) for Bitcoin (BTC). Some smaller amounts were also sent through privacy-focused services like Umbra Cash.

The hacker who targeted KelpDAO has almost completely converted the 75,700 ETH (worth $175 million) they stole into Bitcoin. They primarily used the THORChain protocol for this cross-chain conversion, which generated $800 million in transaction volume and $910,000 in platform fees for THORChain.

— 余烬 (@EmberCN) April 23, 2026

According to on-chain analyst EmberCN, the hacker moved almost all of their stolen Ethereum into Bitcoin using THORChain. This activity generated $800 million in trades for the THORChain protocol and earned it $910,000 in fees.

Rapid laundering via THORChain

THORChain is an open platform that lets you easily swap cryptocurrencies without needing to rely on intermediaries, provide personal information, or worry about centralized control.

The hacker who targeted rsETH converted stolen ETH into Bitcoin, frequently doing so in smaller amounts to avoid significant price changes and ensure the trades went through. Initial estimates suggest around $80 million was directly swapped from ETH to BTC, with the remaining funds converted through similar methods.

The money ended up at Bitcoin addresses after being split up and routed through privacy measures, making it harder to follow. Because THORChain uses a decentralized system with independent nodes and liquidity pools instead of traditional centralized bridges, the transactions went through automatically, even though the people running THORChain said they weren’t taking sides regarding where the money came from.

This event demonstrates how decentralized exchanges that operate across different blockchains can be used to move large amounts of illegally obtained funds, especially when other methods are blocked. Bitcoin saw a significant increase in transactions, and experts believe some of this activity was due to the hacker, which caused the price to briefly rise above $78,000.

Why can Bitcoin not be frozen like Arbitrum?

To get back money stolen from hackers, Arbitrum’s Security Council took emergency action. They froze approximately $71 million (30,766 ETH) from the hacker’s account on Arbitrum One and moved it to a secure wallet controlled by the community. This wallet requires further approval from the community (DAO) before the funds can be accessed.

Arbitrum was able to halt the attack because it’s a Layer-2 network with a security council that can step in during emergencies. This council spotted funds connected to the attacker on Arbitrum, quickly moved those funds to a secure wallet, and is now waiting for further approval on how to proceed.

This built-in security feature of the blockchain allowed for rapid responses to incidents, working with law enforcement without requiring the account owner’s approval.

Bitcoin works differently, though. As a foundational blockchain, its cryptocurrency, BTC, doesn’t have any central authority or system that allows anyone to freeze or control funds on their own.

Bitcoin transactions are verified by a network of miners and users, relying on secure cryptography to ensure funds are spent correctly. Once a transaction is added to the blockchain, it’s extremely difficult to change – it would require almost everyone on the network to agree. In the 17 years Bitcoin has existed, this hasn’t happened to freeze or alter any specific account.

As a researcher studying Bitcoin, one thing that consistently impresses me is its inherent resistance to censorship. Unlike traditional financial systems, there’s no central power or automated program on Bitcoin’s core network that can prevent you from accessing or moving your funds. While exchanges or companies holding your Bitcoin *can* freeze your assets if legally required, once you control the private keys – meaning you’re holding your Bitcoin in a non-custodial wallet – no one has the power to block your transactions. It’s a fundamental aspect of its design.

The idea of ‘you control your keys, you control your coins’ comes from Bitcoin’s simple design, which focuses on preventing censorship rather than allowing for complex controls. While platforms like Ethereum and Layer 2 solutions can include features to freeze funds, Bitcoin doesn’t have this ability built into its core code for regular BTC.

Stolen funds still not clean though

Because Bitcoin is designed to be decentralized and doesn’t have central control, the Bitcoin network itself can’t freeze or take control of Bitcoin held in wallets where you own the keys. However, companies like exchanges and payment platforms *can* block transactions to and from certain Bitcoin addresses.

They block deposits and withdrawals from wallets known to be involved in illegal activity—often by using tools that trace the source of funds on the blockchain. This makes it hard for hackers to turn stolen Bitcoin into cash or other assets without raising red flags and potentially having their funds seized.

This difference highlights a key challenge in the crypto world: while blockchains that can be quickly updated offer ways to fix security issues, they also create potential points of control for a few entities. Bitcoin, which relies on a simpler, more established system, prioritizes security and resistance to being frozen, even if it means being less adaptable.

The hacker behind the KelpDAO attack seems to have made it more difficult to stop the stolen funds by sending them to Bitcoin through THORChain. This created a more secure final destination, at least as far as the blockchain is concerned.

Read More

2026-04-23 08:39