Loading article…

Hackers tied to North Korea are suspected of stealing $578 million in April, including a $290 million exploit of the Kelp DAO protocol via LayerZero.
Hackers linked to North Korea are suspected of orchestrating a series of cryptocurrency thefts totaling $578 million throughout April [1, 2]. The most recent incident involved a $290 million exploit of the Kelp DAO protocol, which followed a $285 million heist at the crypto exchange Drift earlier in the month [1].
Key takeaways
The breach of Kelp DAO occurred over the weekend, with attackers utilizing the protocol’s connection to the LayerZero bridge to siphon funds [1]. Rather than breaking encryption or stealing private keys, the hackers exploited the system's reliance on a single verifier to authorize cross-chain messages [2]. This configuration allowed the attackers to feed fraudulent data into the system, which the protocol then processed as legitimate transactions [2].
Following the theft, a dispute emerged regarding responsibility. LayerZero attributed the incident to the hackers and criticized Kelp’s security setup for failing to require multiple verifications [1]. Conversely, Kelp DAO responded by blaming LayerZero for the breach [1]. Critics within the industry have noted that while LayerZero now recommends using multiple independent verifiers, the project’s default settings previously allowed for a single-verifier configuration [2].
The recent activity marks a significant escalation in the financial operations of North Korean hackers, who have stolen approximately $6 billion in cryptocurrency since 2017 [1]. Last year alone, these groups were responsible for the theft of over $2 billion [1]. Analysts suggest that the shift from social engineering to exploiting structural weaknesses in decentralized finance (DeFi) infrastructure indicates a more organized, state-driven effort to meet the financial needs of a sanctioned regime [2].
The scale of the April thefts highlights systemic risks within the DeFi ecosystem, where the failure of one protocol can trigger losses across interconnected platforms [2]. For instance, lending platforms like Aave that accepted the impacted assets as collateral have faced potential losses, demonstrating how a single exploit can ripple through the broader market [2]. As security experts observe, the reliance on "centralized decentralized" configurations—where security depends on complex manual setups—continues to create vulnerabilities that are being systematically targeted [2]. While the Arbitrum network has taken steps to freeze $71 million in stolen ether, the broader impact of these exploits underscores the ongoing challenge of securing cross-chain infrastructure [3].
Coverage is mostly measured — 60 of 75 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
A DAO is a decentralized autonomous organization that uses blockchain-based software and smart contracts to manage organizational processes like voting and finance.
The legal status of DAOs is generally unclear and varies by jurisdiction, though some states like Wyoming have introduced legislation to recognize them as legal entities.
Because DAO code is difficult to alter once live, fixing security holes often requires writing new code and reaching an agreement to migrate all funds to a new system.
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 3 outlets · Jun 3, 2026 · How we report
Voting power is typically coordinated through governance tokens or NFTs, where holding a larger quantity of tokens often translates to greater influence over organizational decisions.