Mixer withdrawal → protocol interaction

Aave v3's assessment for RD-F-090 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Lazarus Group / DPRK TraderTraitor mixer-to-Aave path was active during the April 18 Kelp DAO exploit (deposited 89,567 fraudulent rsETH). Post-freeze: no new mixer-to-protocol interactions detected at Aave as of April 27. Signal fired (Tier C advisory) during the event window. Yellow because confirmed historical firing 9 days ago; Tier C never flips grade.

Sources #

URL
Chainalysis: KelpDAO Bridge Exploit April 2026Chainalysis KelpDAO blogretrieved 2026-04-27
Internal
T-10 Aave v3 dry run — Cat 6/11 findingsT-10 §2.3 Cat 6/11 findingsretrieved 2026-04-27

Methodology #

Detect whether a wallet that recently withdrew from Tornado Cash, Railgun, or similar mixer has interacted with this protocol.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol aave-v3 factor RD-F-090 score yellow collected_at 2026-04-27 23:28:46