Wallets linked to the KelpDAO attack continued moving funds after PeckShield reported that 75,700 ETH had been sent to two new addresses on April 21. ZachXBT said about $1.5 million was later bridged from Ethereum mainnet to Bitcoin through Thorchain, while another roughly $78,000 was transferred via Umbra. ZachXBT also said the attack address’s initial funds came from Tornado Cash, adding detail on the source and laundering routes used in the post-attack movements.