The KelpDAO exploiter moved 75,700 ETH (approximately $175 million) across two new wallet addresses on April 21, 2026. This happened just hours after Arbitrum’s Security Council announced that froze 30,766 ETH linked to the same hack.
Meanwhile, this suggests the attacker is actively trying to stay ahead of recovery efforts.
KelpDAO Exploiter Moves $175M ETH to New Wallets
Arbitrum’s Security Council had hardly finished celebrating their freezing of 30,766 ETH (worth $70 million) when the exploiter made their next move.
According to blockchain security firm PeckShieldAlert, the KelpDAO attacker transferred a total of 75,700 ETH to two brand new wallet addresses.
On-chain data confirms the transfers are clearly split into two parts.
- Firstly, around 25,000 ETH ($57.93M) were sent to address 0xF980…15910.
- Secondly, around 50,700 ETH ($117.48M) were sent to the address 0xABc8…36FAD.
Meanwhile, both transactions were flagged, and the source wallet is labeled Kelp DAO Exploiter 1 on-chain trackers.
Umbra Cash and THORChain: A Two-Layer Escape Route
What makes this situation more serious is not just how fast the funds are moving, but where they are going.
Small ETH transfers have already gone through Umbra Cash, which hides transaction traces using one-time addresses.
But the movement didn’t stop there.
Blockchain security firm CertiK reports that the attacker is also shifting funds to Bitcoin using THORChain, a system that allows assets to move between blockchains without a central exchange.
Together, these tools help the attacker first hide the trail on Ethereum and then move funds completely out of the network into Bitcoin, making recovery much harder.
Old Wallet Nearly Empty, Not Even Gas Fees Left
The original wallet has now been almost completely drained. Only about 0.768 ETH remains, not enough to cover future transaction fees. This clearly shows the attacker has exited the address and shifted operations to new wallets.
That freeze clearly triggered an immediate response from the exploiter, who wasted no time scattering the remaining funds.
What Comes Next?
For now, the situation is still tense. All attention is on whether Arbitrum’s Security Council, law enforcement, and blockchain trackers can act quickly enough to follow the new wallet movements.
The 30,766 ETH that was frozen earlier is still safely locked. However, the 75,700 ETH now sitting in two new wallets is not secured, making the next steps very important.
At the same time, security teams are now closely watching these new addresses. Any further movement could give clues about the attacker’s next step.
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
