KelpDAO-linked attack funds began moving, with about $1.5 million bridged from Ethereum mainnet to the Bitcoin network through THORChain. ZachXBT said another about $78,000 moved through Umbra. ZachXBT said the attacker addresses were initially funded from Tornado Cash, and the laundering is still ongoing.