On-chain tracking data shows that attackers linked to the North Korean hacking group TraderTraitor have transferred most of the previously traceable funds from the Kelp DAO cross-chain attack. As the funds flowed into various privacy tools, the difficulty of subsequent recovery has significantly increased.
The amount involved is approximately US$220 million.
The funds transferred amounted to approximately $220 million, representing a portion of assets stolen during the Kelp DAO cross-chain vulnerability incident but for which tracking had not yet completely disappeared. Latest developments indicate that the vast majority of these funds have been laundered.
According to on-chain data, the attackers transferred assets through various privacy-focused services in an attempt to sever the direct link between the original address and subsequent flows.
- THORChain
- Wasabi
- Tornado Cash
- Umbra
The original wallet only had about $1.7 million left.
Currently, only about $1.7 million remains in the wallet that initially received the stolen funds. This means that very little asset remains in the directly observable address, further reducing the space for law enforcement and on-chain investigators to take immediate action.
For victims, the most direct impact of this change is that the probability of recovering assets that have not been frozen is decreasing. As funds are split and transferred through multiple layers, the cost of subsequent identification and interception will also increase.
The focus of the investigation may shift to the withdrawal process.
As on-chain paths become more complex, the focus of the investigation is expected to shift from simply tracking addresses to monitoring potential withdrawal channels. In other words, it will be more important to pay attention to whether these assets will reappear on trading platforms, over-the-counter networks, or other fiat currency exchange points.
If attackers attempt to convert the assets into fiat currency, investigators may continue to trace the funds through withdrawal accounts, facilitators, and cross-platform transfer records.
