Kelp DAO hack fund tracker
2026-04-18 · about $293.0M stolen · Cross-chain message spoofing
First stop for the funds
Where transfers out of the tagged wallets went first, valued on the day of each transfer.
When the funds moved
Value moved out of the tagged wallets each month (transfers of $10K or more).
Funds trail, step by step
| Step | Went to | Value |
|---|---|---|
| 1st hop | Plain wallets | $278.4M |
| 1st hop | Contracts (swap services, bridges, other apps) | $40.0M |
| 2nd hop | Contracts (swap services, bridges, other apps) | $213.5M |
| 2nd hop | Plain wallets | $44.7M |
The 2nd hop follows ETH sent on by the 10 wallets that received the most in the 1st hop. Funds can pass through the same wallets more than once, so these totals can be larger than the amount stolen. “Contracts” are smart contracts such as swap services, bridges and other apps without a public label in our lists; “plain wallets” are ordinary addresses. Laundering usually runs through many of both, and through other chains we don’t follow.
Wallets that received the most
| Wallet | Received from attacker | ETH there now |
|---|---|---|
| 0xd4b87b…171530 | $59.5M | 0.04 |
| 0x62c725…3fc64e | $57.9M | 0.00 |
| 0x9fc305…36996f | $31.0M | 0.00 |
| 0x57bb04…fbac27 | $30.8M | 0.00 |
| 0xd4748d…730c2c | $27.5M | 0.00 |
| 0xd37bbe…ad7146 contract | $27.2M | 0.00 |
| 0x4feea1…d6c3c8 | $25.3M | 0.00 |
| 0x3ed3e6…02e0b5 | $13.6M | 0.00 |
| 0x74de5d…016631 contract | $10.7M | 0.00 |
| 0xf607be…c06f27 | $4.5M | 0.00 |
Latest transfers out of the attacker wallets
| When | Coin | Amount | Value then | To |
|---|---|---|---|---|
| 2026-04-24 6 months ago |
ETH | 4.96 | $12K | 0xcdbf6e…05fe21 |
| 2026-04-23 6 months ago |
ETH | 160.14 | $380K | 0xd1a687…2cbcf0 |
| 2026-04-23 6 months ago |
ETH | 9.00 | $21K | 0xd1a687…2cbcf0 |
| 2026-04-23 6 months ago |
ETH | 216.31 | $514K | 0xd4748d…730c2c |
| 2026-04-23 6 months ago |
ETH | 220.57 | $524K | 0x9fc305…36996f |
| 2026-04-23 6 months ago |
ETH | 276.81 | $658K | 0x57bb04…fbac27 |
| 2026-04-23 6 months ago |
ETH | 300.00 | $713K | 0xd4748d…730c2c |
| 2026-04-23 6 months ago |
ETH | 300.00 | $713K | 0x3ed3e6…02e0b5 |
| 2026-04-22 6 months ago |
ETH | 31.00 | $72K | 0x9fc305…36996f |
| 2026-04-22 6 months ago |
ETH | 166.37 | $387K | Contract |
| 2026-04-22 6 months ago |
ETH | 7.82 | $18K | Contract |
| 2026-04-22 6 months ago |
ETH | 400.00 | $931K | 0xd4748d…730c2c |
| 2026-04-22 6 months ago |
ETH | 10.85 | $25K | 0xd4748d…730c2c |
| 2026-04-22 6 months ago |
ETH | 10.89 | $25K | 0xd4748d…730c2c |
| 2026-04-22 6 months ago |
ETH | 10.84 | $25K | 0x9fc305…36996f |
| 2026-04-22 6 months ago |
ETH | 164.24 | $382K | Contract |
| 2026-04-22 6 months ago |
ETH | 10.85 | $25K | 0x9fc305…36996f |
| 2026-04-22 6 months ago |
ETH | 17.00 | $40K | 0x4feea1…d6c3c8 |
| 2026-04-22 6 months ago |
ETH | 400.00 | $931K | 0x4feea1…d6c3c8 |
| 2026-04-22 6 months ago |
ETH | 410.93 | $956K | 0xd4748d…730c2c |
| 2026-04-22 6 months ago |
ETH | 200.00 | $465K | 0x57bb04…fbac27 |
| 2026-04-22 6 months ago |
ETH | 17.00 | $40K | 0x3ed3e6…02e0b5 |
| 2026-04-22 6 months ago |
ETH | 14.29 | $33K | 0x4feea1…d6c3c8 |
| 2026-04-22 6 months ago |
ETH | 22.32 | $52K | 0x9fc305…36996f |
| 2026-04-22 6 months ago |
ETH | 20.00 | $47K | 0x9fc305…36996f |
| 2026-04-22 6 months ago |
ETH | 20.00 | $47K | 0x9fc305…36996f |
| 2026-04-22 6 months ago |
ETH | 20.00 | $47K | 0x9fc305…36996f |
| 2026-04-22 6 months ago |
ETH | 124.68 | $290K | Contract |
| 2026-04-22 6 months ago |
ETH | 20.00 | $47K | 0xd4748d…730c2c |
| 2026-04-22 6 months ago |
ETH | 20.00 | $47K | 0xd4748d…730c2c |
Tagged attacker wallets (64)
| Etherscan tag | ETH now |
|---|---|
| Kelp DAO Exploiter 13 | 0.10 |
| Kelp DAO Exploiter 15 | 0.06 |
| Kelp DAO Exploiter 14 | 0.05 |
| Kelp DAO Exploiter 2 | 0.02 |
| Kelp DAO Exploiter 6 | 0.01 |
| Kelp DAO Exploiter 4 | 0.01 |
| Kelp DAO Exploiter 3 | 0.01 |
| Kelp DAO Exploiter 47 | 0.01 |
| Kelp DAO Exploiter 65 | 0.00 |
| Kelp DAO Exploiter 66 | 0.00 |
| Kelp DAO Exploiter 42 | 0.00 |
| Kelp DAO Exploiter 53 | 0.00 |
| Kelp DAO Exploiter 40 | 0.00 |
| Kelp DAO Exploiter 20 | 0.00 |
| Kelp DAO Exploiter 62 | 0.00 |
| Kelp DAO Exploiter 31 | 0.00 |
| Kelp DAO Exploiter 33 | 0.00 |
| Kelp DAO Exploiter 63 | 0.00 |
| Kelp DAO Exploiter 45 | 0.00 |
| Kelp DAO Exploiter 17 | 0.00 |
| Kelp DAO Exploiter 38 | 0.00 |
| Kelp DAO Exploiter 54 | 0.00 |
| Kelp DAO Exploiter 57 | 0.00 |
| Kelp DAO Exploiter 61 | 0.00 |
| Kelp DAO Exploiter 59 | 0.00 |
Showing the 25 largest of 64; all are included in the totals.
Hack date, amount and method: DefiLlama hacks database. Attacker wallets: public Etherscan tags. Transfers read from the Ethereum blockchain, last updated 2026-10-27 12:38 UTC. Only ETH and tracked tokens are valued; transfers under $10K are left out. Information only. We don’t recover funds or identify people.
Questions
Where did the stolen Kelp DAO funds go?
From the 64 wallets Etherscan tags as the Kelp DAO attacker, we see $278.4M to plain wallets, $40.0M to contracts (swap services, bridges, other apps). Most funds pass through further wallets after the first hop, so this shows the first step only.
How much is still in the Kelp DAO attacker wallets?
About $678 in ETH and tracked tokens, read from the blockchain on 2026-10-27T12:38 UTC.
How much was stolen in the Kelp DAO hack?
DefiLlama's hacks database records about $293.0M lost on 2026-04-18 (cross-chain message spoofing).
Does Deep Blue Alpha recover stolen funds?
No. We show public on-chain transfers from wallets that Etherscan has tagged. We don't trace funds beyond what is shown, recover assets, or identify people.
