KelpDAO has reportedly lost more than $280 million after attackers drained positions across multiple Decentralized Finance (DeFi) protocols on Ethereum and Arbitrum.
On-chain investigator ZachXBT flagged the incident on April 18, identifying six attacker-controlled wallets actively moving the stolen funds.
How the KelpDAO Attack Happened
Blockchain data shows the attacker wallets received initial funding through Tornado Cash, the privacy mixer, hours before the theft began.
The wallets then interacted with DeFi protocols, executing token approvals and swaps through KyberSwap and KelpDAO before converting all positions into ether (ETH).
“KelpDAO appears to have had $280M+ stolen one hour ago on Ethereum and Arbitrum. The attack addresses were funded via Tornado Cash,” ZachXBT wrote on Telegram.
Within roughly one hour, the attackers consolidated approximately 75,700 ETH, worth around $178 million at current prices, into a single wallet.
The remaining stolen value includes additional tokens and positions on Arbitrum. As of publication, no outflows from the consolidation wallet had been detected.
The pattern suggests a private-key compromise rather than a smart-contract exploit in any specific protocol.
The victim appears to have held significant DeFi exposure across both chains, and the attacker systematically withdrew and swapped those positions into raw ETH.
A Growing Pattern of Whale-Targeted Attacks
The incident follows a sharp rise in phishing and social engineering attacks targeting high-value holders.
In January 2026 alone, a single phishing victim lost $284 million, accounting for over 70% of the month’s total crypto theft losses.
If confirmed at $280 million, this would rank among the largest individual wallet compromises on record.
Security analysts are expected to publish deeper on-chain analysis in the coming hours.
Elsewhere, reports also indicate that the Instagram account of Solana meme coin launchpad Pump.fun has been compromised.
“Any posts made from the official pump fun Instagram account should not be trusted. Ignore any and all posts made by the account until we have secured the account,” the team wrote.
Nevertheless, Pump.fun platforms remain operational and user funds are safe.
The post KelpDAO Loses $280 Million in DeFi Wallet Drain Across Ethereum, Arbitrum appeared first on BeInCrypto.
