Kelp DAO Exploit Funds Moved to Bitcoin as DeFi Rescue Begins

Add TechGaged as your preferred source on Google

See more TechGaged stories across Google News and Discover.

Add

The Kelp DAO exploiter has now fully exited Ethereum (ETH) exposure, swapping 75,701 ETH worth roughly $175 million into Bitcoin (BTC). In particular, the transactions were routed through THORChain and similar cross-chain pathways, marking a decisive shift in the handling of stolen funds. At the same time, DeFi protocols are moving to contain the fallout, with Mantle (MNT) and Lido (LDO) proposing capital injections.

Hacker rotates funds into Bitcoin

Indeed, on-chain activity highlighted by Lookonchain on April 24 shows the attacker executing a series of swaps that gradually converted ETH into BTC, likely to reduce traceability and diversify holdings. Specifically, the full amount, 75,701 ETH, has now been moved, making this one of the largest post-exploit asset rotations in recent months.

As a reminder, the exploit itself traces back to an April 18 breach involving Kelp DAO’s rsETH bridge and minting of about $292 million in unbacked tokens. The attacker then used a significant portion of those funds as collateral on Aave V3 to borrow legitimate assets, leaving the protocol exposed to an estimated $124 million to $230 million in potential bad debt.

The attacker’s decision to convert ETH into BTC follows a familiar playbook as in previous exploits. Bitcoin offers deeper liquidity and fewer direct ties to decentralized finance (DeFi) protocols, which makes it a common destination after the completion of the initial laundering routes.

DeFi treasuries move to contain damage

With the attacker now largely out of ETH, attention has shifted to mitigation. Mantle has introduced a proposal to lend up to 30,000 ETH, valued at around $70 million, to Aave (AAVE). The loan would carry a yield based on Lido staking rates plus an additional margin, with a maturity of up to 36 months.

The proposal includes risk controls such as collateral requirements, a first-lien structure, and additional backing from Aave in the form of tokens and revenue share. Alongside this, Lido DAO is considering a one-time contribution of 2,500 stETH, worth roughly $5.8 million, to help reduce the deficit.

This marks a broader shift in how DeFi handles systemic risk. Instead of isolated protocol responses, treasuries are increasingly acting as backstops, deploying capital to stabilize interconnected ecosystems.

In conclusion, the outcome now depends on governance approvals and execution speed. The attacker has already made their move. The question is whether DeFi can move just as fast to absorb the shock.