Cybersecurity — 2026-04-20

Kelp DAO loses $290M attributed to DPRK TraderTraitor; LayerZero publishes post-mortem pointing to Lazarus toolkit

Blockchain security firms observed more than $290 million exiting the Kelp DAO yield protocol beginning Saturday afternoon. LayerZero, the cross-chain messaging infrastructure behind the platform, published an early-Monday post-mortem attributing the complex multi-hop attack to North Korea's TraderTraitor subset of the Lazarus operation, citing tooling and laundering patterns consistent with prior incidents. TRM Labs and other observers tracked the stolen funds through conversion hops matching the Drift-exploit pattern from earlier in April. US officials and UN panels attribute more than $2 billion in 2025 crypto theft to DPRK, with proceeds directed at the weapons program.

Analysis
This is the third nine-figure TraderTraitor hit in three weeks, corroborated across LayerZero's post-mortem and TRM Labs on-chain cross-checks, putting 2026 on pace to exceed, not merely match, last year's ~$2B DPRK crypto revenue. The stolen funds are very likely to clear via HTX, eXch, and Sinbad mixer pathways within 30-45 days; OFAC designations inside that window could recover 60-70%, with the remainder probably reaching weapons-program finance within 90 days. What looked like an isolated social-engineering breakdown at Drift is now a monthly cadence, reframing 2026 DPRK crypto revenue as a step-up year rather than parity. The operational tempo implies DPRK rebuilt, or never fully lost, the infrastructure Justice disrupted in March.

2 sources

North Korea hackers blamed for $290M crypto theft - TechCrunch
Crypto infrastructure company blames $290 million theft on North Korean hackers - The Record