The story is moving fast again. Just days after the KelpDAO rsETH exploit shocked the market, the attacker has taken another bold step. This time, the funds did not just move, they changed form. In about 36 hours, the KelpDAO Hacker converted nearly $175 million worth of Ethereum into Bitcoin.
The KelpDAO hacker has swapped nearly all of its 75,700 $ETH holdings, worth about $175 million, into $BTC over roughly a day and a half.
The cross-chain swaps were primarily routed through THORChain. Due to the sheer size of the transactions, the laundering activity also… pic.twitter.com/LM1d9hWL7j
— Wu Blockchain (@WuBlockchain) April 23, 2026
The speed stands out. The scale is even bigger and now, the focus shifts. It is no longer just about the hack. It is about what happens next and whether anyone can still track or recover these funds.
Massive $ETH Swap Happens Fast
On-chain data shows the KelpDAO Hacker swapped around 75,700 $ETH into $BTC. The process took roughly one and a half days. Most of these swaps went through THORChain. This platform allows users to move assets across blockchains without using centralized exchanges. That matters here. It means the attacker did not need approval or identity checks.
The funds moved freely across networks. But here is what stands out. The volume was huge. These swaps alone created nearly $800 million in trading activity. At the same time, THORChain earned about $910,000 in fees. So while the funds were being moved quietly, the network activity spiked loudly.
Why The Hacker Switched To Bitcoin
The move from Ethereum to Bitcoin is not random. It follows a pattern seen in past exploits. Bitcoin is harder to freeze once it moves. It also has deeper liquidity. That makes it easier to split and move funds further. Earlier, part of the stolen $ETH was frozen on Arbitrum. That likely forced the KelpDAO Hacker to act quickly and this is where things changed. Instead of slow laundering, the attacker accelerated the process. By switching to $BTC, the funds are now on a different chain. That adds another layer of complexity for tracking teams.
DeFi Feels The Pressure Again
The impact of the KelpDAO rsETH exploit is still spreading. Protocols are working to manage the damage. Stani Kulechov shared an update on the situation. He said the team is focused on protecting users and restoring stability.
The past few days have been intense, but I wanted to give some updates as we continue to work on this. Our priority is our users, and every decision we are making is aimed at an orderly return to normal market conditions and the best possible outcome for everyone involved.…
— Stani (@StaniKulechov) April 22, 2026
“We are working around the clock… every decision we are making is aimed at an orderly return to normal market conditions,” he noted. At the same time, the earlier recovery of about $70 million in $ETH has helped reduce some risk. But the larger problem remains. Bad debt created during the exploit is still under review and many users are waiting for clarity on losses.
What This Means Right Now
This event shows how fast things can escalate. First, the KelpDAO rsETH exploit created fake assets. Then, real funds were borrowed. Now, those funds are moving across chains. Each step makes recovery harder. At the same time, it highlights a deeper issue. Cross-chain systems offer speed and flexibility. But they also create new risks. The actions of the KelpDAO Hacker show how quickly attackers can adapt. Additionally, while teams respond, the market is watching closely. Because this is no longer just one exploit. It is becoming a real-time test of how strong DeFi systems truly are.