On April 7, 2026, Stabble, a decentralized exchange built on Solana, issued an urgent advisory instructing all liquidity providers to immediately remove their funds. The move followed a public disclosure by onchain investigator ZachXBT, who linked a former Stabble employee to suspected North Korean (DPRK) IT operations. Although Stabble stressed that no exploit or breach had occurred, the incident sent shockwaves through the crypto community.
Former Employee Identity and ZachXBT's Allegations
The former employee was identified as Keisuke Watanabe, who operated under aliases including kasky53, keisukew53, kdevdivvy, and 0xWoo across GitHub and social platforms. In a post on X, ZachXBT directed information at Elemental (a Solana DeFi infrastructure project where Watanabe had also worked), revealing his full name, associated Solana and Ethereum wallet addresses, email, and supporting OSINT documentation.
Stabble's new management team, which took over the project roughly four weeks before the disclosure, confirmed that Watanabe had worked at Stabble approximately one year earlier. In an urgent message from the Stabble account, the team wrote: “EMERGENCY! guys please temporally withdraw your liquidity instantly! Better safe than sorry. The new stabble team.” A follow-up statement clarified: “We are not PR people, we are quants and early DeFi degens. Our primary focus is the safety of our LPs. There has been no exploit. We received a message and are acting on it.”
Limited TVL and Broader Context
At the time of the alert, Stabble's total value locked (TVL) stood at approximately $1.75 million, with a significant portion concentrated in a single wallet. While substantial withdrawals were already underway, the limited TVL contained the scope of potential risk. The incident fits a documented pattern: DPRK-linked IT workers infiltrating crypto and DeFi projects for at least seven years, often posing as Japanese or other foreign developers. U.S. authorities and independent researchers have flagged suspected North Korean workers inside more than 40 DeFi platforms. The recent $280 million Drift Protocol exploit on Solana, attributed to North Korean actors, involved months of social engineering rather than a smart contract vulnerability.
Community Reactions and Next Steps
Community response to Stabble's handling was split. Some users praised the transparent and swift action, while others criticized the “EMERGENCY” framing as likely to cause unnecessary panic without a confirmed threat. Stabble's new team plans to contact major auditing firms before resuming liquidity operations, with no confirmed timeline. The team reported operational gains before the incident, including doubled TVL, a 3-4x revenue increase, and a 100% price increase — all of which remain intact as no funds were lost.
ZachXBT's disclosure connected Watanabe to Elemental founder “Moo” during commentary on the Drift hack, with Stabble caught in the broader call-out through its prior association with the same individual. Elemental founder Moo rejected accusations of virtue signaling and shifted focus to accountability, stating: “When major failures occur, the minimum standard is to acknowledge mistakes, communicate transparently, and face users directly.”
The Stabble case underscores the growing pressure on crypto projects to vet contributors through background checks, code review isolation, and privilege controls. While no funds were lost, the incident adds to a list of cases where DPRK-linked identity fraud reached projects long after the operative had moved on. The new team's decision to pause operations and seek fresh audits reflects a precautionary posture over optics.