Eight days after a $36 million exploit, Humanity Protocol announced a full recovery plan: a new audited H token, 1:1 airdrop for affected holders, a compensation fund for edge cases, and a mainnet relaunch. The attack was linked to DPRK-affiliated actors.
Elliptic links Drift Protocol’s $286 million exploit to North Korean hackers, marking the largest crypto hack of 2026. DRIFT token drops over 40% as funds are laundered across chains.
On-chain analyst Tay says developers allegedly tied to North Korea contributed to more than 40 DeFi projects, including SushiSwap, Thorchain, Yearn Finance, Fantom, and Harmony, raising fresh concerns over hiring controls and internal security.
LayerZero published a joint post-mortem with Mandiant and CrowdStrike on the April 18 rsETH bridge exploit. North Korean hackers TraderTraitor used social engineering to breach a developer account, manipulated RPC nodes, and bypassed a single-verifier setup, draining 116,500 rsETH ($292M).
The Financial Action Task Force, or FATF, released its seventh targeted update on the implementation of standards for virtual assets and virtual asset service providers on July 16, showing wider legal adoption of the Travel Rule across surveyed jurisdictions while warning that stablecoins now account for the largest share of identified illicit on-chain activity. The report said 91 of 109 jurisdictions, or 83%, have enacted Travel Rule legislation, up from 73% in 2025. Including 11 more jurisdictions still in the legislative process, total coverage reached 93%. FATF also reported some improvement in compliance ratings. The share of jurisdictions rated “Largely Compliant” rose to 34% from 29% a year earlier, while those rated “Partially Compliant” fell to 43% from 50%. Still, the body said legislation alone does not mean effective implementation, citing gaps in supervisory capacity, cross-border data exchange, regulatory consistency and engagement with VASPs. The report placed particular focus on stablecoins and DeFi. FATF said most identified illicit on-chain activity now involves stablecoins, with use expanding among DPRK actors, terrorist financiers and cross-border drug trafficking groups. It also flagged the emergence of purpose-built stablecoins designed to bypass issuer freezing and seizure mechanisms. On DeFi, only 18% of surveyed jurisdictions had completed a risk assessment and another 9% were in progress, leaving most jurisdictions without a developed oversight framework.
Wazirx suspends INR and crypto withdrawals after a $230 million security breach on its multisig wallet. Analysts link the attack to North Korea's Lazarus Group, raising concerns about exchange security.
Lazarus Group has been preliminarily linked to the KelpDAO exploit that drained about $292 million in rsETH. While Arbitrum froze roughly $71 million in ETH, onchain tracking suggests another $175 million was moved to fresh Ethereum addresses.
LayerZero Labs attributed the $290M KelpDAO exploit to a sophisticated infrastructure attack by Lazarus group, asserting zero contagion. However, Chainlink's Zach Rynes and other community members criticized verifier centralization as the root cause, escalating the DeFi security debate.
