Loading story…
Zerion published a security incident post-mortem, and LayerZero later issued a KelpDAO incident statement, with both incidents being publicly tied in threat-intelligence discussion to DPRK activity. Social-media reporting around the disclosures specifically associated the KelpDAO case with TraderTraitor, the North Korean cluster known for targeting cryptocurrency and Web3 organizations through social engineering and wallet compromise.
The available references do not provide technical indicators, loss figures, or a detailed attack chain, but they place both disclosures in the context of crypto-focused intrusions attributed to North Korean operators. For CISOs in digital-asset, DeFi, and wallet ecosystems, the incidents reinforce the ongoing risk from DPRK-linked campaigns that exploit trusted workflows, third-party relationships, and user-facing transaction processes to gain access and move funds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A Bluesky post on 2026-05-09 references a publication titled "LayerZero Update" by LayerZero. The available content does not include the substance of the update, but it indicates a new official follow-up communication related to the KelpDAO/LayerZero incident.
KelpDAO published a statement titled "Setting the Record Straight Around the LayerZero Bridge Hack," indicating a further official clarification related to the incident. The available reference does not provide substantive new technical, impact, or attribution details beyond the existence of this follow-up statement.
A referenced article titled "Where did the kelp $292m go? anatomy of a $292m laundering" reported on laundering activity involving $292 million linked to the KelpDAO incident. The available post provides no further technical details, but it indicates a broader accounting of stolen-fund movement than earlier reports of transfers to new addresses.
An Arkm research item shared on Bluesky reported that funds linked to the KelpDAO hacker were transferred to new cryptocurrency addresses. The reported movement involved $175 million and occurred on 2026-04-22, indicating post-incident laundering or fund relocation activity.
KelpDAO published an item titled 'April 18 Incident: Additional Context,' indicating a follow-up disclosure about the incident. The available reference does not provide substantive technical or impact details beyond the existence of this additional context statement.
LayerZero published a "KelpDAO Incident Statement" referenced in a 2026-04-20 Bluesky post. The post's hashtags suggest a cybersecurity incident possibly linked to DPRK-related threat activity, but no substantive incident details are provided in the available content.
Zerion published a "Security Incident: Post Mortem" referenced in a 2026-04-15 Bluesky post. The available content does not provide further details on the incident, impact, or attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcebsky.app
Open sourcebsky.app
Open sourcebsky.app
Open sourcebsky.app
Open sourcebsky.app
Open sourcebsky.app
Open sourcebsky.app
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked hackers were attributed to two major cryptocurrency thefts in April: the **$285 million Drift Protocol breach** and the **$292 million KelpDAO exploit**, which together accounted for **76% of all crypto hack losses recorded through April 2026**. TRM Labs said the operations fit Pyongyang’s established pattern of carrying out a small number of highly targeted, high-value intrusions rather than frequent lower-value attacks, pushing cumulative North Korea-attributed crypto theft above **$6 billion since 2017**. The two attacks used different intrusion paths and laundering chains. In the Drift case, attackers reportedly spent months on social engineering, abused **Solana durable nonce transactions**, and leveraged a governance configuration change to drain funds in about **12 minutes**. In the KelpDAO theft, the attackers allegedly exploited a **single-verifier LayerZero bridge** design after compromising internal RPC nodes and using DDoS pressure to force reliance on poisoned data. TRM said the stolen assets then moved along separate routes: Drift funds were bridged to Ethereum and left dormant, while KelpDAO proceeds were partly frozen on Arbitrum and the remainder rapidly flowed through **THORChain** into Bitcoin in a pattern resembling **TraderTraitor** operations, reinforcing THORChain’s role as a recurring laundering route in major North Korea-linked crypto heists.
Jun 29, 2026
Attackers linked with North Korea’s **Lazarus Group** exploited Kelp DAO’s LayerZero-powered `rsETH` bridge by compromising off-chain verification infrastructure and abusing a **1-of-1 DVN** setup, fraudulently releasing about **116,500 rsETH** worth roughly **$292 million**. The stolen tokens were posted as collateral on **Aave** to borrow real assets, creating an estimated **$124 million to $230 million** in bad debt, driving severe liquidity stress, and contributing to a broader DeFi selloff. Kelp DAO and LayerZero publicly disputed responsibility after LayerZero first blamed Kelp’s configuration, then later acknowledged its own mistake in allowing its DVN to operate as the sole verifier for a high-value route; a later forensic report said the intrusion began with social engineering of a LayerZero developer and was attributed with high confidence to DPRK-linked **TraderTraitor/UNC4899**. Arbitrum’s Security Council froze about **30,766 ETH**—roughly **$71 million**—linked to the exploit, but the recovery effort became entangled in U.S. litigation after terrorism-judgment creditors sought to seize the assets as alleged North Korean property. A federal judge later allowed an Arbitrum DAO vote to move the frozen ETH to **Aave LLC** while preserving the restraining notice, leaving ownership unresolved as DeFi United worked to recapitalize `rsETH`, Kelp burned attacker-held tokens on Arbitrum, and most of the remaining **$220 million** in unfrozen funds were reportedly laundered through **THORChain**, **Wasabi**, **Tornado Cash**, and **Umbra**. In the aftermath, Kelp migrated `rsETH` bridging to **Chainlink CCIP**, and the incident accelerated broader protocol moves away from minimal LayerZero verifier configurations.
Jun 29, 2026
Drift Protocol disclosed that a malicious actor gained unauthorized access to its environment, according to a post amplified by cyber threat intelligence account **lazarusholic**. Public details remain limited, and the available reporting does not specify the intrusion vector, affected systems, or operational impact, but the incident has drawn attention in CTI circles because of possible links to **DPRK**-associated activity. Separately, researchers at **PhatomCandle** reported a highly stealthy campaign using spoofed IT tools to deliver **EtherRAT**, with suspected ties to a North Korean advanced persistent threat. The two reports point to ongoing interest in financially and operationally motivated intrusions associated with suspected DPRK actors, spanning both direct compromise of crypto-related platforms and malware distribution through deceptive tooling.
Jun 29, 2026