North Korea’s Lazarus Group steals $635 million in April crypto hacks

In April 2026, North Korea‑linked Lazarus Group siphoned $635 million from crypto protocols, with two flagship exploits—$285 million on Drift (Solana) and $292 million on Kelp DAO (Ethereum via LayerZero)—accounting for roughly 95 % of the month’s losses [2][4].

The attacks and immediate fallout

The Drift exploit on Solana compromised $285 million, while the Kelp DAO breach on Ethereum’s LayerZero bridge resulted in $292 million disappearing [2][4]. The stolen Kelp DAO tokens (rsETH) were quickly used as collateral on Aave, generating $190 million in bad debt and prompting a wave of withdrawals that cut Aave’s total value locked (TVL) from $26.4 billion to below $14 billion, ending its reign as the largest DeFi protocol by TVL [1]. The Kelp DAO hack was one of 25 incidents in April that together caused $630 million in losses—the worst month since February 2025’s $1.5 billion Bybit breach [1].

Market reaction and broader impact

The string of high‑profile hacks has eroded confidence in Ethereum’s security, reflected in market pricing that now assigns a 0.4 % probability to ETH reaching $4,000 in April, down from 1 % just 24 hours earlier [2][4]. Bitcoin’s odds of hitting $79,000 by month‑end have similarly slipped to 0.6 % [2][4]. Analysts link the declining sentiment to the scale of the attacks and the apparent vulnerability of layer‑2 bridges, which together accounted for most of the $635 M loss [2][4].

Ongoing repercussions for DeFi

Beyond the immediate capital drain, the Kelp DAO breach highlighted systemic risks: the attacker’s ability to move stolen assets across protocols created a cascade of bad debt and forced Aave’s TVL to tumble by roughly $12 billion. Although net outflows from Aave’s lending markets have eased in the past month, TVL has remained stuck between $13.9 billion and $15.1 billion, showing no clear recovery [1].

What to watch

• Aave TVL: Monitor whether TVL rebounds above $15 billion, a potential sign of restored confidence.
• Ethereum bridge activity: Large movements of rsETH or other bridged assets could indicate further exploitation or attempts to liquidate stolen funds.
• Regulatory signals: Any U.S. Treasury or SEC actions targeting North Korean cyber‑operations may shift market sentiment quickly.

The April onslaught underscores how state‑backed actors can destabilize DeFi ecosystems, raising questions about the resilience of cross‑chain bridges and the need for coordinated security responses.