The KelpDAO Layer Zero attacker ramps up laundering by bridging stolen funds through Thorchain to the Bitcoin network, mirroring tactics from the 2025 Bybit hack. SpecterAnalyst tracked the flows, revealing DPRK's TraderTraitor group split 75.7K ETH (~$174.7M) across three wallets after Arbitrum Council froze 30.7K ETH (~$71M). Funds hit BTC addresses like bc1qt3fxzwgqayqgukgr6ny5ns9vpdpcgt72f6wwfs, commingling with prior DPRK crypto theft proceeds.

Laundering Details and Thorchain Role

Laundering kicked off at 07:39 UTC, with the attacker deploying over 400 addresses and channeling ~99% via Thorchain, spiking its daily swap volume to $211M—over 10x the 30-day average. This generated $189K in fees, while THORNodes, run by permissionless operators, opted not to intervene despite community awareness. Echoing crypto market crash vulnerabilities, the pattern underscores persistent threats from state actors like DPRK in cross-chain exploits.

ETH Technical Confluence Analysis

Zooming into ETH's 4-hour chart amid these crypto hacking incidents, price action holds bullish above the EMA200 at $2212.0, with the EMA50 at $2312.26 acting as immediate support to absorb any downside from laundering shocks. Momentum stays neutral via RSI(14) at 49.32, but the MACD(12,26) golden cross at -5.62 signals building upside conviction—price trades snug inside Bollinger Bands, testing upper resistance at $2354.42 while lower support at $2273.64 caps volatility exhaustion. Confluence here points to a tactical pullback toward EMA50 before resuming the trend, especially if BTC correlation drives flows post-bridge.