The investigations into the 2026 exploits targeting the Kelp DAO and Humanity Protocol have taken on a new dimension as a result of the most recent on-chain activity.
ZachXBT, a blockchain analyst, noticed that money taken from the two different attacks had recently been mixed.
This suggests that assets from both exploits were moved through the same wallet or transaction flow. Interestingly, this also reveals a connection between the attackers.
How much of the stolen funds were moved?
The Humanity Protocol attacker transferred 15,403 ETH, worth $23.6 million, to a relatively new Ethereum [ETH] address, according to Specter. After that, the money was transferred to the Bitcoin [BTC] network, where it was combined with earnings linked to the KelpDAO exploit.
As of now, over $8 million of the stolen money has been laundered by the Humanity Protocol attacker.
For context, the Lazarus Group uses this well-known tactic to combine the profits from various operations into one Bitcoin wallet before transferring them via mixers and over-the-counter desks.
That said, the Kelp DAO exploit drained about $292 million from its LayerZero bridge in April 2026.
Meanwhile, Humanity Protocol lost about $32 million in June. This happened when the hackers gained access to the deployer account and team-controlled wallets via a developer’s compromised device.
Is the exploit linked to the Lazarus Group?
Until now, the Humanity Protocol hack had raised suspicions that insiders might have been involved in the attack.
However, the new combination with the Kelp DAO exploit’s laundering trail points to a shared external threat actor or closely related cybercriminal network.
Since the funds were associated with North Korea, the plaintiff argued, they were entitled to confiscate any funds belonging to North Korean-affiliated organizations as part of the money owed in unpaid judgments.
Plaintiffs currently own over $877 million in unpaid judgments against North Korea from U.S. courts.
The continuing risk in DeFi
This commingling occurs at a time when MEV bots are also growing in power in on-chain markets.
While these automated systems have now made the market more efficient, the Jaredfromsubway.eth incident shows how skilled attackers can still manipulate even highly specialized trading infrastructure.
Together, these attacks highlight the rising security threats DeFi faces. While all this happens, ETH’s price also fell to an intraday low of $1,581.76 amid the wider market decline.
Final Summary
- Stolen funds from both Kelp DAO and the Humanity Protocol exploit have been reported to have been commingled.
- As of the last update, over $8 million of the stolen money has been laundered by the Humanity Protocol attacker.
