Umbra

Tornado

Privacy-focused crypto protocol Umbra said it has taken down its front-end website to make it more difficult for hackers who have been using it to move funds from recent “high-profile hacks.”
Umbra <a href="https://x.com/UmbraCash/status/2046586711313182753" rel="noopener noreferrer nofollow">posted</a> to X on Tuesday that it is aware that around $800,000 worth of stolen funds were moved via its protocol.
It added that it made the decision to move the hosted version of its front end into maintenance mode and would restore it “as soon as we are assured that doing so won't create obstacles to the current recovery efforts.”
It comes just days after the Kelp protocol was exploited for over $280 million, which is suspected to have been carried out by North Korean hackers. Recent <a href="https://x.com/PeckShieldAlert/status/2046513131535626396?s=20" rel="noopener noreferrer nofollow">reports</a> pointed to Umbra as among the protocols that the exploiter has been attempting to use to bridge funds from Ether to Bitcoin.&nbsp;
North Korean hacking groups are <a href="https://cointelegraph.com/news/us-treasury-sanctions-north-korea-it-worker-crypto-fraud-network" rel="noopener noreferrer nofollow">heavily sanctioned</a> by the US, and multiple crypto platforms have worked to freeze or stifle the hackers’ efforts to move the funds.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019db3cb-cd96-7340-af42-e6ee1f5db986.png" alt="Privacy protocol Umbra shuts front end to stifle Kelp exploiters">
 <figcaption>Source: <a href="https://x.com/UmbraCash/status/2046586711313182753" rel="noopener noreferrer nofollow">Umbra</a>
 </figcaption>
</figure>
Umbra said, however, that there was “nothing we can do” to stop anyone from using its smart contracts or a local or self-hosted version of its open-source front end.
<h2 id="roman-storm-warns-front-end-freeze-isn-t-enough">Roman Storm warns front end freeze isn’t enough</h2>
Roman Storm, co-founder of the <a href="https://cointelegraph.com/news/us-prosecutors-tornado-cash-roman-storm-copyright-argument" rel="noopener noreferrer nofollow">crypto mixer Tornado Cash</a>, argued the move to pause the front end may not be enough to avoid ire from authorities.&nbsp;
Storm was convicted in August of conspiring to operate an unlicensed money transmitting business, despite arguing that he was not in control of how the protocol was used.&nbsp;
“Prosecutors in my case called me a liar when I said that I can’t control Tornado Cash,” said Storm, who <a href="https://cointelegraph.com/news/us-prosecutors-seek-retrial-tornado-cash-roman-storm-after-mixed-verdict" rel="noopener noreferrer nofollow">beat charges</a> of conspiring to violate US sanctions.
He claimed that authorities viewed “changing a front end is the same thing as controlling an entire protocol.”
Related: <a href="https://cointelegraph.com/news/private-key-compromises-led-crypto-hack-losses-decade" rel="noopener noreferrer nofollow">Crypto hackers stole $17B over past 10 years: DefiLlama</a>
“If you can make changes to the user interface, including further updates through new builds on IPFS, then you are in full control,” he added.
In its post, Umbra said that its protocol was “useful for protecting the identity of the receiver, not the sender,” and wasn’t useful for hackers wanting to obscure their money trail.&nbsp;
“All the stolen funds moved through the protocol can be identified, and we have been in touch with security researchers who are involved,” it added.
Magazine: <a href="https://cointelegraph-magazine.com/south-korea-gets-rich-from-crypto-north-korea-gets-weapons/" rel="noopener noreferrer nofollow">South Korea gets rich from crypto… North Korea gets weapons</a>

Privacy protocol Umbra shuts front end to stifle Kelp exploiters

Table of Contents

Cointelegraph

Other articles published on Apr 22, 2026

Join our free newsletter for daily crypto updates!