KelpDAO has reportedly lost more than $292 million after attackers drained positions across multiple Decentralized Finance (DeFi) protocols on Ethereum and Arbitrum.

On-chain investigator ZachXBT flagged the incident, identifying six attacker-controlled wallets actively moving the stolen funds.

Blockchain data shows the attacker wallets received initial funding through Tornado Cash, the privacy mixer, hours before the theft began.

The wallets then interacted with DeFi protocols, executing token approvals and swaps through KyberSwap and KelpDAO before converting all positions into ether (ETH).

“KelpDAO appears to have had $280M+ stolen one hour ago on Ethereum and Arbitrum. The attack addresses were funded via Tornado Cash,” ZachXBT wrote on Telegram.

Within roughly one hour, the attackers consolidated approximately 75,700 ETH, worth around $178 million at current prices, into a single wallet.

The remaining stolen value includes additional tokens and positions on Arbitrum. As of publication, no outflows from the consolidation wallet had been detected.

The pattern suggests a private-key compromise rather than a smart-contract exploit in any specific protocol.

The victim appears to have held significant DeFi exposure across both chains, and the attacker systematically withdrew and swapped those positions into raw ETH.

AAVE MULTISIG GUARDIAN FREEZES RSETH ON LENDING MARKETS: ONCHAIN

The incident follows a sharp rise in phishing and social engineering attacks targeting high-value holders.

In January 2026 alone, a single phishing victim lost $284 million, accounting for over 70% of the month’s total crypto theft losses.

If confirmed at $292 million, this would rank among the largest individual wallet compromises on record.

Security analysts are expected to publish deeper on-chain analysis in the coming hours.

KelpDAO has not publicly addressed the incident, and did not immeidately respond to BeInCrypto’s request for comment.

Elsewhere, reports also indicate that the Instagram account of Solana meme coin launchpad Pump.fun has been compromised.

“Any posts made from the official pump fun Instagram account should not be trusted. Ignore any and all posts made by the account until we have secured the account,” the team wrote.

Nevertheless, Pump.fun platforms remain operational and user funds are safe.

The post KelpDAO Loses $292 Million in DeFi Wallet Drain Across Ethereum, Arbitrum appeared first on BeInCrypto.

Bitcoin price in Telegram @btc_price_every_hour

110 +