North Korea Linked to $578M in April Crypto Heists

Hackers linked to North Korea are suspected of orchestrating a series of cryptocurrency thefts totaling $578 million throughout April [1, 2]. The most recent incident involved a $290 million exploit of the Kelp DAO protocol, which followed a $285 million heist at the crypto exchange Drift earlier in the month [1].

Key takeaways

• North Korean hacking groups, including the entity known as TraderTraitor, are suspected of carrying out the recent string of high-value exploits [1, 2].
• The Kelp DAO attack was facilitated by a security configuration that relied on a single verifier to approve cross-chain transactions [1, 2].
• In response to the Kelp DAO breach, the Arbitrum network moved $71 million in ether tied to the exploit into a frozen intermediary wallet [3].
• Security experts suggest these attacks represent a coordinated, state-driven campaign rather than isolated incidents [2].

Anatomy of the Kelp DAO Exploit

The breach of Kelp DAO occurred over the weekend, with attackers utilizing the protocol’s connection to the LayerZero bridge to siphon funds [1]. Rather than breaking encryption or stealing private keys, the hackers exploited the system's reliance on a single verifier to authorize cross-chain messages [2]. This configuration allowed the attackers to feed fraudulent data into the system, which the protocol then processed as legitimate transactions [2].

Following the theft, a dispute emerged regarding responsibility. LayerZero attributed the incident to the hackers and criticized Kelp’s security setup for failing to require multiple verifications [1]. Conversely, Kelp DAO responded by blaming LayerZero for the breach [1]. Critics within the industry have noted that while LayerZero now recommends using multiple independent verifiers, the project’s default settings previously allowed for a single-verifier configuration [2].

A Sustained Campaign

The recent activity marks a significant escalation in the financial operations of North Korean hackers, who have stolen approximately $6 billion in cryptocurrency since 2017 [1]. Last year alone, these groups were responsible for the theft of over $2 billion [1]. Analysts suggest that the shift from social engineering to exploiting structural weaknesses in decentralized finance (DeFi) infrastructure indicates a more organized, state-driven effort to meet the financial needs of a sanctioned regime [2].

Why it matters

The scale of the April thefts highlights systemic risks within the DeFi ecosystem, where the failure of one protocol can trigger losses across interconnected platforms [2]. For instance, lending platforms like Aave that accepted the impacted assets as collateral have faced potential losses, demonstrating how a single exploit can ripple through the broader market [2]. As security experts observe, the reliance on "centralized decentralized" configurations—where security depends on complex manual setups—continues to create vulnerabilities that are being systematically targeted [2]. While the Arbitrum network has taken steps to freeze $71 million in stolen ether, the broader impact of these exploits underscores the ongoing challenge of securing cross-chain infrastructure [3].