The KelpDAO exploiter moved 75,700 ETH (approximately $175 million) across two new wallet addresses on April 21, 2026. This happened just hours after Arbitrum’s Security Council announced that froze 30,766 ETH linked to the same hack.
Meanwhile, this suggests the attacker is actively trying to stay ahead of recovery efforts.
Arbitrum’s Security Council had hardly finished celebrating their freezing of 30,766 ETH (worth $70 million) when the exploiter made their next move.
According to blockchain security firm PeckShieldAlert, the KelpDAO attacker transferred a total of 75,700 ETH to two brand new wallet addresses.
On-chain data confirms the transfers are clearly split into two parts.
Meanwhile, both transactions were flagged, and the source wallet is labeled Kelp DAO Exploiter 1 on-chain trackers.
What makes this situation more serious is not just how fast the funds are moving, but where they are going.
Small ETH transfers have already gone through Umbra Cash, which hides transaction traces using one-time addresses.
But the movement didn’t stop there.
Blockchain security firm CertiK reports that the attacker is also shifting funds to Bitcoin using THORChain, a system that allows assets to move between blockchains without a central exchange.
Together, these tools help the attacker first hide the trail on Ethereum and then move funds completely out of the network into Bitcoin, making recovery much harder.
The original wallet has now been almost completely drained. Only about 0.768 ETH remains, not enough to cover future transaction fees. This clearly shows the attacker has exited the address and shifted operations to new wallets.
That freeze clearly triggered an immediate response from the exploiter, who wasted no time scattering the remaining funds.
For now, the situation is still tense. All attention is on whether Arbitrum’s Security Council, law enforcement, and blockchain trackers can act quickly enough to follow the new wallet movements.
The 30,766 ETH that was frozen earlier is still safely locked. However, the 75,700 ETH now sitting in two new wallets is not secured, making the next steps very important.
At the same time, security teams are now closely watching these new addresses. Any further movement could give clues about the attacker’s next step.
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
All opinions and insights shared represent the author's own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
The crypto market has slipped into green today, with Bitcoin trading around $75,900, up over…
The Reddit XRP community is divided over whether a proposed U.S. crypto bill could change…
Arbitrum has moved quickly to contain fallout from the KelpDAO exploit, freezing over 30,766 ETH,…
A Reddit post has sparked debate inside the XRP community after a user spent two…
Imagine your grandmother puts her life savings into Aave - one of the biggest DeFi…
The Arbitrum Security Council has taken emergency action to freeze 30,766 ETH (worth $70 million)…
