'Mysterious' 300,000 XRP Users: Who Are They and Why Does XRP Ledger Look Unnatural
XRP Ledger sees a mysterious spike of 300,000 new users, raising suspicions.
U.Today1 min read
Kelp DAO attacker moves $175M in Ether after exploit: Arkham
TL;DR
The attacker of the Kelp DAO exploit has moved approximately $175 million in Ether across multiple transactions to newly created addresses, likely to launder the stolen funds. This follows a significant exploit where around $290 million was drained from Kelp DAO's LayerZero-powered bridge.
Key points
- Attacker moved 75,700 Ether worth $175 million
- Total stolen from Kelp DAO was approximately $290 million
- LayerZero warned against Kelp DAO's single verifier path setup
Mentioned in this story
LayerZero
Kelp DAOTHORChainUmbra
The attacker behind the roughly $290 million Kelp DAO exploit began moving tens of thousands of Ether to newly created blockchain addresses on Tuesday, in an apparent effort to start laundering the stolen funds.
The wallet tagged by Arkham as linked to the Kelp DAO exploit moved about 75,700 Ether (ETH) worth roughly $175 million across three transactions on Tuesday, including a 25,000 ETH transfer to one newly created address and transfers of 50,700 ETH and 0.7 ETH to another.
Blockchain investigator ZachXBT wrote in a Tuesday Telegram post that addresses tied to the exploit had begun moving funds through THORChain and Umbra. He flagged three THORChain transactions totaling about $1.5 million and a separate $78,000 transfer through Umbra.
On Saturday, an attacker drained about 116,500 restaked Ether (rsETH), worth roughly $290 million to $293 million at the time, from Kelp DAO’s LayerZero-powered rsETH bridge.
LayerZero said Kelp DAO’s 1/1 decentralized verifier network (DVN) setup created a single point of failure by relying on a single verifier path for cross-chain messages. LayerZero said it had previously advised against that configuration.
Fallout spreads across DeFi
The transfers came hours after Arbitrum said its 12-member security council had taken emergency action to freeze 30,766 ETH tied to the exploit and move the funds into an “intermediary frozen wallet” accessible only through Arbitrum governance.
Kelp DAO Attacker-tagged wallet, latest transactions. Source: Arkham
The exploit also hit other DeFi protocols, including Aave, where the attacker used the against the protocol. Early estimates put the hole at about $195 million, but Aave’s April 20 incident report later : roughly $123.7 million in bad debt under one scenario and about $230.1 million under another.
Q&A
How much Ether was moved by the Kelp DAO attacker?
The Kelp DAO attacker moved about 75,700 Ether, worth roughly $175 million.
What was the total amount stolen in the Kelp DAO exploit?
The total amount stolen in the Kelp DAO exploit was approximately $290 million.
What vulnerabilities did LayerZero identify in Kelp DAO's setup?
LayerZero identified that Kelp DAO's decentralized verifier network created a single point of failure by relying on a single verifier path for cross-chain messages.
