The attacker behind the KelpDAO bridge drain has converted nearly the entire 75,700 ETH stash, worth about $175 million, into Bitcoin over roughly a day and a half, according to a post from WuBlockchain citing on-chain flows. BTC traded at $77,884 and ETH at $2,348 as of April 23, 2026, per CoinMarketCap data.
The swap closes a chapter that began when the KelpDAO exploiter drained the LayerZero bridge for $292 million, making it the largest DeFi incident of 2026 so far. Earlier rounds of laundering moved roughly $80 million through Thorchain. This latest rotation is larger, faster, and harder to reverse.
Why rotate into Bitcoin at all
Bitcoin is a cleaner asset to hold for an exploiter. There is no contract-level freeze equivalent to what Arbitrum's security council did with 30,766 ETH. There is no issuer like Tether that can blacklist an address. Once funds settle on the Bitcoin base layer, the only recovery path is a compromised off-ramp or a voluntary return.
Ethereum, by contrast, sits under a dense layer of social and technical controls. Aave's governance has already frozen rsETH markets despite full backing. Custodians, stablecoin issuers, and front-end operators all have tools to flag tainted ETH and ERC-20 balances. Rotating to BTC strips most of that away.
The trade-off is price exposure. The attacker accepted BTC market risk instead of holding ETH, and the 36-hour window suggests the swap was executed in chunks rather than a single block, likely through Thorchain-style cross-chain swaps combined with centralized venues where KYC is weaker.
What is left for recovery
The numbers matter here. Arbitrum froze 30,766 ETH on its end, worth around $72 million at current prices. That sum was already segregated before this rotation. A separate $274M USDT withdrawal linked to a Justin Sun wallet exited Aave during the same broader contagion, but that flow is not stolen funds, it is counterparty flight.
What moved today is different. The 75,700 ETH represents the portion the attacker fully controlled after bridge withdrawal, minus the pieces already pushed through Thorchain in prior rounds. Converting that remainder to BTC effectively locks in fiat value while shedding the jurisdictional handles that Ethereum infrastructure still offers.
Analytics firms and the LayerZero, KelpDAO, and Aave incident response teams will now be watching BTC deposit addresses across exchanges. Any attempt to cash out through a regulated venue is the most likely chokepoint. So far, none of the teams involved have confirmed a consolidated list of flagged Bitcoin addresses.
The wider DeFi picture
The KelpDAO event has already reshaped risk pricing across lending protocols. Aave's TVL dropped by roughly $6 billion after the exploit surfaced, and deposits fell $15 billion as users pulled liquidity preemptively. AAVE's token lost 22% on the news.
This BTC rotation does not directly worsen the DeFi-side picture, but it signals that the attacker considers the Ethereum laundering window closed. That is a practical tell: when an exploiter stops trying to integrate funds back into the ecosystem and starts rotating wholesale into Bitcoin, it usually means the on-chain net is tight enough to force a hard exit.
For Ethereum-native protocols, the open question is whether future restaking-adjacent bridge designs can tolerate this class of failure without requiring governance freezes. The KelpDAO incident produced three separate emergency actions across Aave, Arbitrum, and LayerZero. None of them stopped the funds from reaching Bitcoin.
Overview
The KelpDAO exploiter has converted nearly all 75,700 ETH, about $175 million at April 23 prices, into Bitcoin over 36 hours. The move strips Ethereum-side freeze and blacklist tools from recovery efforts and concentrates the endgame on Bitcoin exchange deposit addresses. Arbitrum's 30,766 ETH freeze and prior Thorchain laundering account for most remaining traceable flows.
