BlockBeats News, June 2nd, in the April Kelp DAO cross-chain bridge attack incident, about $292 million of assets were stolen. Apart from approximately $71 million worth of ETH that was frozen, the remaining $220 million in funds has been largely laundered. Currently, the attacker's original address holds only about $1.7 million in assets. On-chain analysis shows that the attacker has used privacy tools such as THORChain, Wasabi, Tornado Cash, and Umbra to complete multiple rounds of cross-chain transactions and coin mixing, making most of the funds untraceable.

Previously, investigative agencies attributed this attack to the North Korean hacker group Lazarus Group (TraderTraitor/UNC4899). A day after the attack, the hacker split about 75,700 ETH (then valued at around $175 million) into multiple new addresses, crossed them to the Bitcoin network via THORChain, and then used tools like Wasabi CoinJoin and Tornado Cash for coin mixing. During this period, the related fund flows briefly drove THORChain's daily transaction volume to surge to $394 million, more than ten times the normal level.

The only asset currently with a relatively high chance of recovery is about 30,766 ETH (approximately $71 million) frozen by the Arbitrum Security Council. However, these assets have become embroiled in a new legal dispute. The U.S. Southern District of New York Federal Court previously issued a restraining order to temporarily freeze the related funds because some relatives of North Korean terrorism victims are seeking to confiscate these assets through legal proceedings to enforce a compensation judgment.