Kelp DAO and Humanity Protocol Hacks Linked Through Commingled Stolen Funds

A recent investigation into two separate DeFi hacks has uncovered a surprising connection between the attackers. ZachXBT, a blockchain analyst, discovered that funds stolen from the Kelp DAO and Humanity Protocol exploits have been commingled.

The commingling of assets suggests that the same attacker or closely related cybercriminal network was responsible for both hacks. The Humanity Protocol attacker transferred 15,403 ETH, worth $23.6 million, to a new Ethereum address, which was then moved to the Bitcoin network and combined with funds from the Kelp DAO exploit.

The total amount of laundered funds is estimated to be over $8 million. This tactic is reminiscent of the Lazarus Group's method of combining profits from various operations into one Bitcoin wallet before transferring them via mixers and over-the-counter desks.

The Kelp DAO exploit, which occurred in April 2026, drained about $292 million from its LayerZero bridge, while Humanity Protocol lost around $32 million in June. The latter incident raised suspicions that insiders might have been involved in the attack, but the new evidence points to a shared external threat.