Arkham tracked the suspected Lazarus Group-linked KelpDAO attacker moving 76,000 ETH, worth about $175 million, from the $292 million theft into new on-chain addresses. The movement followed containment on Arbitrum, where about $71 million in stolen ETH linked to the attack had been frozen. The excerpt says the original exploit unlocked 116,500 rsETH through a forged LayerZero message and had been heavily linked to North Korea's Lazarus Group. The funds were also routed through Umbra and cross-chain swaps to Bitcoin via THORChain, indicating an active laundering and exit strategy rather than dormant holdings.