KelpDAO Hacker Swaps 75,700 ETH for BTC in $175M Transaction

A hacker linked to the KelpDAO exploit has swapped approximately 75,700 ETH for BTC in a single large-scale transaction valued at roughly $175 million, according to on-chain data. The conversion marks one of the larger post-exploit asset rotations tracked in recent months and has drawn attention from blockchain analysts monitoring the movement of stolen funds.

What Happened in the KelpDAO Hacker’s 75,700 ETH-to-BTC Swap

Blockchain records show that a wallet tied to the KelpDAO exploit executed a swap of approximately 75,700 ETH into BTC. The transaction was flagged by on-chain tracking tools shortly after execution.

The wallet in question, 0xF9802c5EB6b972Ba686aFa7CA615910Ea8310b85, has been identified by blockchain intelligence platforms as connected to the KelpDAO rsETH exploit. Arkham Intelligence has tagged the entity in its explorer database, allowing analysts to trace the flow of funds.

The scale of the swap makes it a notable event in crypto security circles. A discussion thread on the Arbitrum Foundation governance forum previously outlined precautionary actions taken in response to the rsETH exploit, providing additional context on the incident’s broader impact across DeFi protocols.

Why a Hacker Would Rotate ETH Into BTC

The decision to convert a large ETH position into BTC after an exploit is a pattern that blockchain forensics teams have observed in previous incidents. BTC’s deeper liquidity and wider availability across mixing services and cross-chain bridges can make it a preferred asset for actors attempting to obscure fund trails.

A swap of this magnitude also creates visible sell pressure on the Ethereum side of the trade. Large-scale conversions between the two most liquid crypto assets tend to attract attention from traders and automated monitoring systems, similar to how Binance’s recent net inflow of 217M USDT drew scrutiny from on-chain observers tracking major capital movements.

Asset-Tracking Implications

Once funds move from Ethereum to Bitcoin, the tracing challenge shifts between two fundamentally different blockchain architectures. Ethereum’s account-based model provides different forensic signals than Bitcoin’s UTXO model, and investigators must bridge analytics across both chains.

The fact that the wallet was already flagged by Arkham Intelligence suggests that tracking efforts are active. However, the conversion to BTC may complicate recovery efforts if the funds are subsequently moved through privacy-enhancing tools or additional cross-chain hops.

What the Move Means for KelpDAO and DeFi Security

The movement of exploit-linked funds renews attention on KelpDAO’s security posture and the broader challenges facing liquid restaking protocols. When stolen assets are actively being converted rather than sitting idle, it signals that the attacker is taking steps to liquidate, which often reduces the probability of full fund recovery.

User Confidence in Restaking Protocols

Large exploits and subsequent fund movements erode trust in the affected protocol and, by extension, in similar DeFi products. For KelpDAO users, the active laundering of stolen funds is a reminder that the incident remains unresolved.

Security events of this scale tend to accelerate capital rotation across the ecosystem. Exchange platforms continue to expand their asset offerings in parallel, with Coinbase recently launching new spot trading pairs, while users reassess where to hold and stake their assets.

Security Lessons for DeFi Protocols

The incident highlights the importance of real-time monitoring and rapid response capabilities. Protocols that integrate on-chain alerting systems can detect large unauthorized movements faster, potentially enabling quicker coordination with exchanges to freeze assets before conversion.

The Arbitrum Foundation’s precautionary response to the rsETH exploit demonstrates one model for cross-protocol coordination. Whether similar measures can be effective after funds have already been converted to BTC remains an open question.

How Markets May Read a Large ETH-to-BTC Transaction

A swap of this size, regardless of its origin, is large enough to register on short-term order flow analysis. For ETH, the conversion represents concentrated sell pressure. For BTC, the inflow adds marginal buy-side volume.

Market participants monitoring whale movements and exchange flows will likely note the transaction in the context of broader ETH/BTC ratio trends. Platforms that surface real-time flow data, such as Binance’s Alpha dashboard with its historical returns tracking, give traders tools to contextualize these kinds of outsized movements.

The psychological effect may be more significant than the direct market impact. Headlines about hackers converting stolen funds into BTC can reinforce negative sentiment around DeFi security while drawing attention to Bitcoin’s role as the default exit asset in the crypto ecosystem.

FAQ About the KelpDAO Hacker’s BTC Swap

How much ETH did the KelpDAO hacker swap?

The hacker swapped approximately 75,700 ETH, valued at roughly $175 million at the time of the transaction.

What asset did the hacker convert to?

The ETH was converted to BTC. This type of cross-asset rotation is common in post-exploit scenarios where attackers seek to move funds across different blockchain networks.

Why does converting ETH to BTC matter?

Moving funds from Ethereum to Bitcoin changes the forensic landscape for investigators. It also signals active laundering rather than dormant funds, which can reduce the likelihood of recovery.

Has KelpDAO recovered any of the stolen funds?

Based on available information, the status of fund recovery efforts has not been confirmed. The active conversion of stolen ETH to BTC suggests that at least a significant portion of the exploited funds remains under the attacker’s control.

Where can I verify the transaction on-chain?

The wallet linked to the exploit can be viewed on Etherscan. Arkham Intelligence also maintains a tagged entity profile for the associated addresses.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.