North Korea linked to $578 M crypto heists in April after Kelp DAO

A $292 million hack of the Kelp DAO yield protocol on Saturday pushed total crypto thefts attributed to North Korean actors in April to $578 million, the largest monthly sum since the Bybit breach [1]. The breach, traced to a single‑verifier flaw in LayerZero’s cross‑chain messaging, underscores growing state‑backed threats to decentralized finance.

How the Kelp DAO exploit unfolded

LayerZero, the cross‑chain messaging provider, said the attackers abused Kelp DAO’s “1‑of‑1 DVN” verifier configuration, allowing a single compromised node to approve fraudulent messages without a backup check [2]. The hack released $292 million of assets, overtaking the $285 million Drift exploit that occurred on April 1 [1]. Blockchain investigator Tanuki42 linked the stolen funds to the same North Korean subgroup, TraderTraitor, confirming a pattern of commingling across incidents [1].

Broader implications for DeFi security

The incident prompted the Arbitrum Security Council to freeze 30,766 ETH tied to the exploit, a rare governance intervention that highlights tension between decentralization and loss mitigation [1]. Ledger CTO Charles Guillemet called the freeze “probably good” but noted the discomfort it creates for neutral infrastructure [1]. The attacks illustrate a shift from code‑level bugs to vulnerabilities in the underlying infrastructure and verification models, expanding the attack surface for state‑backed actors [1].

What to watch

• Arbitrum governance actions – any further fund‑freezing decisions could signal evolving norms for roll‑up security.
• LayerZero verifier upgrades – adoption of multi‑verifier setups may reduce single‑point failures.
• North Korean activity spikes – monitor for additional DeFi exploits or cross‑chain attacks linked to TraderTraitor.

The April thefts demonstrate that North Korean cyber units are adapting their tactics, targeting not just smart‑contract bugs but the bridges and messaging layers that connect blockchains. Whether the industry will coalesce around stronger governance interventions or accept inevitable losses remains an open question.