KelpDAO Suffers Massive $292 Million Loss to DeFi Hackers
We have always followed the principles of transparency and clear information. Some of our content includes affiliate links, and we may earn a small commission through these partnerships. These partnerships do not influence our editorial independence or opinion. By using our site, you accept our privacy policy and terms and conditions.
A Web3 and NFT expert, Elena focuses on the evolution of digital art and blockchain gaming for CryptoWinx. She combines technical expertise with a deep…
Cryptocurrency is a high-risk asset class, and investing carries significant risk, including the potential loss of some or all of your investment. The information on this website is provided for informational and educational purposes only and does not constitute financial, investment, or gambling advice. Cryptowinx does not endorse any specific exchange or gaming platform. For more details, please read our terms and full disclaimer.
Cryptowinx navigates the digital asset universe with a dynamic, forward-looking vision. Throughout our evolution, we have followed every market cycle, from vertical rises to corrections, always remaining a solid point of reference for our community. Our team is made up of industry experts and analysts who experience the blockchain ecosystem daily: we constantly monitor Bitcoin’s stability, study the expansion of the Ethereum ecosystem, and analyze the new frontiers of crypto casinos. We are committed to absolute editorial integrity, separating the signal from the noise through rigorous fact-checking and multi-perspective news analysis. In a landscape where innovations emerge in moments, our mission is to simplify complex concepts and offer transparency into what is established and what is still experimental.
Learn more Cryptowinx
KelpDAO has experienced a significant financial setback, with losses exceeding $292 million following a coordinated attack that compromised various Decentralized Finance (DeFi) protocols on both Ethereum and Arbitrum.
The breach was brought to light by blockchain investigator ZachXBT, who tracked the movement of stolen assets to six wallets controlled by the attackers.
According to on-chain data, the malicious wallets were initially funded through Tornado Cash, a mixer known for its privacy features, just hours prior to the execution of the theft. Once funded, the attackers proceeded to manipulate DeFi protocols, using services like KyberSwap and KelpDAO to conduct token approvals and swaps before ultimately converting their holdings into ether (ETH).
Within a narrow window of approximately one hour, the hackers managed to amass around 75,700 ETH, which translates to about $178 million at present market values, into a consolidated wallet. The total stolen value also included other tokens and assets located on Arbitrum. At this time, no withdrawals from the consolidated wallet have been identified.
This attack appears to stem from a compromise of private keys rather than exploiting vulnerabilities inherent in any specific smart contract. The investigation reveals that KelpDAO had extensive holdings across both chains, which facilitated the assailants’ systematic extraction and conversion of assets into raw ETH.
This incident underscores a troubling trend, as it aligns with an uptick in phishing and social engineering schemes targeting high-value crypto asset holders. In January 2026, a single phishing incident resulted in a loss of $284 million, accounting for more than 70% of that month’s total cryptocurrency theft.
If the $292 million loss is confirmed, it would mark one of the largest individual wallet breaches to date. Security analysts are currently expected to release more detailed on-chain assessments in the hours ahead.
As of now, KelpDAO has not publicly commented on the breach and did not respond to inquiries regarding the incident. Meanwhile, it has also been reported that the Instagram account of Solana meme coin platform Pump.fun has been hacked, prompting the team to issue a warning to users.
However, users can rest assured that the Pump.fun platforms remain operational and their funds are secure. The consequences of the KelpDAO incident serve as a stark reminder of the vulnerabilities present in the DeFi ecosystem and the ongoing threats posed by sophisticated hacking groups.
Leave the reaction
Elena Rodriguez
Commentaries
Add your comment
Fill in necessary fields and publish