Humanity Protocol, Kelp DAO stolen funds commingle – Same attacker?
The investigations into the 2026 exploits focusing on the Kelp DAO and Humanity Protocol have taken on a brand new dimension on account of the newest on-chain exercise.
ZachXBT, a blockchain analyst, observed that cash taken from the 2 completely different assaults had just lately been combined.
This means that belongings from each exploits had been moved by means of the identical pockets or transaction circulation. Curiously, this additionally reveals a connection between the attackers.
How a lot of the stolen funds had been moved?
The Humanity Protocol attacker transferred 15,403 ETH, value $23.6 million, to a comparatively new Ethereum [ETH] tackle, according to Specter. After that, the cash was transferred to the Bitcoin [BTC] community, the place it was mixed with earnings linked to the KelpDAO exploit.
As of now, over $8 million of the stolen cash has been laundered by the Humanity Protocol attacker.
For context, the Lazarus Group makes use of this well-known tactic to mix the earnings from varied operations into one Bitcoin pockets earlier than transferring them through mixers and over-the-counter desks.
That stated, the Kelp DAO exploit drained about $292 million from its LayerZero bridge in April 2026.
In the meantime, Humanity Protocol misplaced about $32 million in June. This occurred when the hackers gained entry to the deployer account and team-controlled wallets through a developer’s compromised system.
Is the exploit linked to the Lazarus Group?
Till now, the Humanity Protocol hack had raised suspicions that insiders might need been concerned within the assault.
Nevertheless, the brand new mixture with the Kelp DAO exploit’s laundering path factors to a shared exterior risk actor or carefully associated cybercriminal community.
For the reason that funds had been related to North Korea, the plaintiff argued, they had been entitled to confiscate any funds belonging to North Korean-affiliated organizations as a part of the cash owed in unpaid judgments.
Plaintiffs at the moment personal over $877 million in unpaid judgments towards North Korea from U.S. courts.
The persevering with danger in DeFi
This commingling happens at a time when MEV bots are additionally rising in energy in on-chain markets.
Whereas these automated methods have now made the market extra environment friendly, the Jaredfromsubway.eth incident reveals how expert attackers can nonetheless manipulate even extremely specialised buying and selling infrastructure.
Collectively, these assaults spotlight the rising safety threats DeFi faces. Whereas all this occurs, ETH’s value additionally fell to an intraday low of $1,581.76 amid the broader market decline.
Closing Abstract
- Stolen funds from each Kelp DAO and the Humanity Protocol exploit have been reported to have been commingled.
- As of the final replace, over $8 million of the stolen cash has been laundered by the Humanity Protocol attacker.
