Adversary Intelligence — 2026-04-20

LayerZero attributes $290M Kelp DAO theft to DPRK; April 1 Drift exploit ($285M) traced to six-month Lazarus social-engineering operation

LayerZero on April 20 formally attributed the weekend $290M cryptocurrency heist at Kelp DAO to North Korean state-sponsored hackers, making it the largest crypto theft of 2026 to date. The attribution comes 19 days after the April 1 $285M exploit at Drift Protocol on Solana, which Elliptic and TRM Labs traced through on-chain forensics to a six-month Lazarus Group social-engineering campaign against Drift personnel. Two attributions in three weeks position the Reconnaissance General Bureau crypto pipeline as having recovered scale after the Hamster Kombat-era law-enforcement seizures, with combined 2026-to-date losses approaching $600M. The Hacker News reported the Drift compromise was AI-augmented spear-phishing tied to fake recruiter personas on LinkedIn, consistent with the FBI-CISA joint TraderTraitor advisory pattern.

Analysis
The infrastructure overlap between the Drift and Kelp DAO compromises shifts the analytical frame from isolated incidents to an ongoing RGB operation against Solana-ecosystem custody, and at a combined $575M pace in 19 days the Reconnaissance General Bureau is very likely on track to exceed 2025's roughly $2B annual take by Q3 2026, already clearing 25 percent of last year's full-year tally. The Drift six-month social-engineering preparation, traced by Elliptic and TRM Labs and reported by The Hacker News, is consistent with FBI-CISA TraderTraitor tradecraft and confirms Lazarus has operationalized AI-assisted recruiter-persona campaigns at scale against custody personnel. The Kelp DAO attribution, corroborated across TechCrunch and Recorded Future's The Record, remains a private-sector LayerZero claim without FBI, Treasury, or CISA confirmation; LayerZero's commercial incentive to deflect scrutiny from its own bridge infrastructure warrants caution, and the on-chain forensic trail could reflect rented criminal infrastructure shared across DPRK and Russian-speaking operators rather than RGB direct action. OFAC mixer designations and a fresh joint cyber advisory targeting Solana-ecosystem custody operators are very likely within the next 30–60 days as attribution pace outstrips the deterrence framework.

3 sources

North Korea hackers blamed for $290M crypto theft - TechCrunch
Crypto infrastructure company blames $290 million theft on North Korean hackers - The Record
$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation - The Hacker News