The Kelp DAO bridge hacker appears to have laundered nearly all of the funds still “unfrozen” after April’s LayerZero exploit, according to on-chain tracking by Arkham Intelligence.
In the original incident, the exploit totaled about $292 million. Later, roughly $220 million remained unfrozen, meaning investigators and exchanges had not fully seized or blocked all of it.
Now, Arkham’s tracking indicates only around $1.7 million is still parked in the original exploiter wallet. That implies the attacker moved and obfuscated the remaining balance through multiple steps, including privacy tooling and follow-on transfers.
Why it matters
Recovery windows are time-bound. Once funds reach new custody, that “freeze then reverse” window starts to close. The Defiant reports that the recovery window is closing as Arkham’s analysts see the drain largely completed.
This matters for anyone affected by bridge risk. Even when part of the stolen amount is initially recoverable, the real battle is how quickly entities can trace, freeze, and coordinate before assets spread across addresses and services.
Market impact
This update is not about token prices. It’s about operational risk in cross-chain infrastructure.
LayerZero-linked exploits already set a high bar for monitoring and incident response. The Defiant’s account, backed by Arkham Intelligence tracking, shows how quickly a large balance can be moved even after some funds are left unfrozen.
What to watch next
With the recovery window closing, the practical questions shift from “can we freeze more” to “can we trace enough for future enforcement.”
The next test is whether investigators can link the remaining outflows to identifiable counterparties and whether any of the still-moving funds get tagged for action before they fully exit the system.
There’s also a narrower technical thread. The Defiant points to privacy-assisted laundering paths. Analysts will likely focus on which privacy steps were used and how reliably those steps can be de-anonymized at scale.
Key facts
| Item | Amount | Source claim |
|---|---|---|
| April LayerZero exploit size | ~$292M | The Defiant report |
| Funds later left unfrozen | ~ $220M | The Defiant report |
| Still parked in original exploiter wallet | ~ $1.7M | Arkham Intelligence tracking, via The Defiant |
| Laundering status | nearly all | The Defiant report |