North Korean hackers have stolen over $500 million from DeFi platforms in less than three weeks, marking a dramatic escalation in their attack strategy. According to blockchain intelligence firm Elliptic and multiple security reports, the total illicit cryptocurrency earnings from North Korea this year have now exceeded $700 million.
The Two Major Heists: Drift Protocol and KelpDAO
The first attack occurred on April 1 against Drift Protocol, resulting in losses of $286 million. Elliptic attributed the attack to North Korean patterns. Just 17 days later, on April 18, KelpDAO was hit for $290 million — the largest single crypto theft of 2026. Security firms confirmed the Lazarus Group’s TraderTraitor unit was behind both attacks.
Tactical Shift: From Smart Contracts to Infrastructure Edge
The recent intrusions reveal a clear tactical evolution. Instead of targeting core smart contract flaws, hackers are now exploiting edge vulnerabilities in the underlying infrastructure. In the KelpDAO incident, attackers compromised LayerZero Labs’ decentralized verification network by manipulating data channels without breaching core cryptography. This method demonstrates a higher level of sophistication, making detection significantly more difficult.
Global Infiltration and Money Laundering Operations
Beyond technical exploits, North Korea has expanded its on-the-ground operations. Intelligence reports indicate that embedded agents have infiltrated several global cryptocurrency companies, gathering internal intelligence over long periods. To date, North Korea’s total digital asset theft has reached $6.75 billion. The Lazarus Group employs complex laundering techniques involving mixers, cross-chain bridges, and decentralized exchanges to evade law enforcement.
These hacks have not only exposed critical security gaps in DeFi infrastructure but also triggered a broader debate over the security of cross-chain messaging protocols like LayerZero. As North Korean cyber operations become more organized and sophisticated, the threat to the crypto ecosystem is now more severe than ever.