Ethereum

Arbitrum

Bitcoin

THORChain

Security

<p><strong>A reported KelpDAO exploiter has moved 75,701 ETH, worth approximately $175 million, into BTC using THORChain and other cross-chain routes, according to on-chain evidence and a related Arbitrum Security Council emergency action.</strong></p>
<h2 id="how-the-reported-175m-eth-to-btc-move-unfolded">How the Reported $175M ETH-to-BTC Move Unfolded</h2>
<p>The reported movement involved 75,701 ETH being converted into Bitcoin through multiple channels. THORChain, a decentralized cross-chain liquidity protocol, was identified as a primary routing mechanism, though the headline and underlying evidence indicate other conversion paths were also used.</p>
<p>The story is classified as a security event spanning both the Ethereum and Bitcoin networks. The scale of the reported transfer, roughly $175 million at the time of movement, places it among the larger exploit-linked fund flows tracked in recent months, comparable in magnitude to cases like the <a rel="noopener noreferrer nofollow">alleged $400K Polymarket insider trading case</a> in terms of enforcement attention, though far larger in dollar terms.</p>
<h2 id="what-the-on-chain-evidence-trail-shows">What the On-Chain Evidence Trail Shows</h2>
<p>Several blockchain explorer records appear linked to the reported movement. An Etherscan transaction record shows activity tied to the event, while a corresponding <a href="https://arbiscan.io/tx/0x5618044241dade84af6c41b7d84496dc9823700f98b79751e257608dac570f6b" rel="noopener noreferrer nofollow">Arbiscan transaction</a> suggests the exploit had an Arbitrum-layer component.</p>
<div class="on-chain-data">
 <p>ON-CHAIN DATA</p>
 <ul>
  <li><strong>Etherscan TX:</strong><a href="https://etherscan.io/tx/0x079984c56c5670108f5c6f664904178f9b364340351949a42e4637d1f645f770" rel="noopener noreferrer nofollow">0x07998…f770</a></li>
  <li><strong>Linked addresses:</strong><a href="https://etherscan.io/address/0x5d3919f12bcc35c26eee5f8226a9bee90c257ccc" rel="noopener noreferrer nofollow">0x5d39…7ccc</a>, <a href="https://etherscan.io/address/0xabc82c8975c922e5aa836b4afd36fad4511a65b8" rel="noopener noreferrer nofollow">0xabc8…65b8</a>, <a href="https://etherscan.io/address/0xd4b87bab0ee142182f7f6da030aefe3e7f171530" rel="noopener noreferrer nofollow">0xd4b8…1530</a></li>
  <li><strong>Reported amount:</strong> 75,701 ETH (~$175M)</li>
 </ul>
</div>
<p>The <a href="https://forum.arbitrum.foundation/t/security-council-emergency-action-21-04-2026/30803" rel="noopener noreferrer nofollow">Arbitrum Security Council posted an emergency action thread</a> that appears connected to the incident, suggesting protocol-level response measures were initiated.</p>
<p>It is important to note that the verification status of these connections remains partial. The available evidence links these transactions and addresses to the reported exploit, but the full laundering path from ETH through THORChain and other routes into BTC has not been conclusively mapped in publicly confirmed analysis. The confidence level in the underlying research is low, meaning readers should treat the routing details as reported rather than fully proven.</p>
<h2 id="why-the-btc-conversion-matters">Why the BTC Conversion Matters</h2>
<p>Converting a large ETH position into BTC through decentralized cross-chain protocols like THORChain is a notable tactical choice. Unlike centralized exchanges, decentralized routing avoids KYC checkpoints and makes asset freezes significantly harder to execute, a pattern that has drawn increasing scrutiny as cross-chain bridge volume grows.</p>
<p>The shift from ETH to BTC also moves the funds onto a network with a different privacy and traceability profile. While Bitcoin transactions are publicly visible, the lack of smart contract complexity can simplify obfuscation through mixing. This mirrors a broader trend in which exploit-linked funds are increasingly routed through decentralized infrastructure, a dynamic that has prompted <a rel="noopener noreferrer nofollow">calls from over 100 crypto firms for clearer regulatory frameworks</a>.</p>
<p>No confirmed market reaction data tied to this specific movement was available in the research for this report. Bitcoin and Ethereum spot prices showed no verified impact attributable to the transfer.</p>
<p>What remains unresolved: whether the full conversion path will be independently confirmed by on-chain analytics firms, whether any portion of the funds can be frozen through protocol-level actions like the Arbitrum Security Council’s emergency measures, and whether official statements from KelpDAO or THORChain governance will provide further clarity. Institutional responses to large-scale exploits, including how protocols coordinate with entities that hold Bitcoin reserves like <a rel="noopener noreferrer nofollow">Metaplanet’s recent 8 billion yen bond raise for BTC</a>, continue to shape how the industry handles post-exploit fund tracing.</p>
<p>Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p>The article <a href="https://theccpress.com/?p=43184" rel="noopener noreferrer nofollow">KelpDAO Hacker Moved 75,701 ETH via THORChain Into BTC</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.</p>

KelpDAO Hacker Moved 75,701 ETH via THORChain Into BTC

Table of Contents

Cryptocurrency Press

Other articles published on Apr 24, 2026

Join our free newsletter for daily crypto updates!