The Lazarus Group, a North Korean state-sponsored hacking collective, has moved approximately $175 million worth of Ethereum following a massive exploit of KelpDAO on April 18. The Arbitrum Security Council had previously frozen 30,766 ETH (worth about $71 million) linked to the attackers on Arbitrum One before the funds could be bridged to Ethereum.
Hack Details: RPC Nodes Compromised, $292M in rsETH Stolen
According to security reports, the attackers infiltrated two RPC nodes and deployed malware to feed false transaction data to Layerzero's decentralized verifier network while maintaining normal feeds to other observers. They then launched DDoS attacks on remaining honest nodes, forcing KelpDAO's bridge to switch to the compromised infrastructure. By controlling the verification layer, they forged cross-chain messages authorizing the withdrawal of 116,500 rsETH—approximately 18% of the total rsETH supply.
This marks the second major attack attributed to Lazarus in just three weeks. On April 1, an operation linked to the group drained about $285 million from Drift Protocol. Combined losses from both incidents approach $600 million.
Arbitrum Freezes Funds, Lazarus Quickly Redirects
On April 20, the Arbitrum Security Council acted on-chain to freeze 30,766 ETH from the KelpDAO exploiters on Arbitrum One before bridge withdrawals to Ethereum could be completed. However, Lazarus subsequently moved approximately $175 million worth of ETH to new Ethereum addresses, which Arkham Intelligence is actively tracking.
The group typically launders stolen funds through chain hopping, DEX swaps, and dispersion across thousands of wallets. Some funds eventually flow through services like Huione Pay and are converted to Bitcoin or other assets used to support North Korea's nuclear and missile programs.
Lazarus Group's Expansive Network: Over $2 Billion Stolen in 2025
Data from Chainalysis and South Korean media reveals that Lazarus stole approximately $2.02 billion in cryptocurrency during 2025, a 51% increase year-over-year and the highest ever for North Korean-linked cyber heists. Despite a 74% drop in the number of separate incidents, the group accounted for 60% to 76% of global service-level cryptocurrency theft. Cumulative lower-bound estimates as of end-2025 reached $6.75 billion.
The single largest cryptocurrency theft in history also belongs to Lazarus: in early 2025, the group hacked Safe Wallet's software supplier and manipulated the developer environment to steal about $1.5 billion from Dubai-based exchange Bybit. The FBI officially attributed the attack to North Korea's Lazarus. Other major confirmed thefts include the Ronin Network bridge ($620M in 2022), DMM Bitcoin ($308M in 2024), and WazirX ($234.9M in 2024).
Lazarus typically prepares for months before executing a heist, using fake job postings, GitHub-hosted malware, and spear-phishing to gain initial access. After infiltrating developer or verifier environments, they steal private keys, hack hot wallets, or manipulate bridge infrastructure. The U.S. Department of Justice has indicted a North Korean national named Park Jin Hyuk for previous Lazarus operations, and OFAC has sanctioned dozens of addresses.
Despite these measures, Lazarus continues to adapt. The RPC node compromise used in the KelpDAO attack reflects a shift from front-end interfaces and user credentials toward the underlying infrastructure of DeFi protocols. Cross-chain bridge security remains a critical vulnerability—multi-signature requirements, independent RPC node audits, and real-time behavioral monitoring are cited as the most direct countermeasures.