Adversary Intelligence — 2026-04-23

LayerZero attributes $290M KelpDAO exploit to DPRK Lazarus Group; attackers begin multichain laundering via Thorchain and Umbra

Blockchain-infrastructure firm LayerZero attributed with moderate-to-high confidence the April 18 $290 million exploit of KelpDAO to DPRK's Lazarus Group, UPI and CoinDesk reported on April 22. CoinDesk tracked roughly $1.5 million bridged from Ethereum to Bitcoin via Thorchain and an additional $78,000 routed through privacy protocol Umbra, consistent with prior Lazarus laundering patterns. The KelpDAO hit follows a Drift Protocol exploit; combined two-week Lazarus takings exceed $500 million, per multiple blockchain analytics firms. Certik separately documented a new Lazarus macOS campaign dubbed Mach-O Man that uses a social-engineering technique called ClickFix to target fintech and crypto-firm executives.

Analysis
The $500 million combined two-week take from Drift and KelpDAO, paired with confirmed Thorchain bridging within 72 hours of exfiltration, establishes an operational tempo defenders cannot match at scale. Certik's parallel documentation of the Mach-O Man macOS social-engineering campaign, distinct from the exploit chain but feeding the same laundering infrastructure, marks this as the signature twin-track intake of the RGB Bureau 121 cryptocurrency-generation program rather than opportunistic criminal activity, a reading corroborated across multiple blockchain analytics firms. On-chain tracking has since surfaced the Thorchain and Umbra bridging steps absent from the first-day picture. OFAC designation of the specific wallet clusters is likely within 30 days given Treasury's post-attribution sanctions pattern, with each additional pre-designation day converting more exfiltrated ETH into eventually-sanctioned liquidity that DeFi operators refuse to touch. LayerZero's attribution confidence is not neutral; the firm has a commercial-recovery incentive to accelerate a DPRK finding, and the attribution warrants sharpening by independent blockchain analytics before treating it as settled.

3 sources