Adversary Intelligence — 2026-04-21

LayerZero attributes $292m KelpDAO exploit to DPRK RGB Lazarus/TraderTraitor; Drift plus Kelp total $575m in 18 days

LayerZero Labs and KelpDAO, per Decrypt and CoinDesk, attributed the 18 April $292 million KelpDAO cross-chain-bridge exploit to the North Korean Reconnaissance General Bureau's Lazarus Group and its TraderTraitor subunit with preliminary confidence. The operators poisoned two remote-procedure-call nodes that LayerZero verifier infrastructure relied on, conducted DoS attacks against decentralized validators, and forced acceptance of malicious cross-chain transactions to withdraw funds. Lazarus is separately assessed responsible for the 1 April Drift Protocol social-engineering exploit against governance signers. Together the two operations moved more than $575 million from DeFi treasuries in 18 days through structurally distinct attack vectors. Treasury OFAC has designated the Lazarus Group, Bluenoroff, and Andariel as North Korean state-sponsored cyber groups.

Analysis
Anchoring two structurally distinct April attack vectors, social-engineering governance signers at Drift on 1 April and poisoning RPC verifier nodes with layered validator DoS at Kelp on 18 April, to a single RGB unit within a three-week span, per converging Decrypt and CoinDesk reporting, upgrades Lazarus/TraderTraitor attribution from tentative to preliminary-confident and makes OFAC enforcement on TraderTraitor mixer addresses a more probable next step than last cycle reporting could justify. The tempo-and-payoff curve tracks Recorded Future's documented pattern of Pyongyang intensifying cyber-theft operations ahead of sanctions cycles and wartime procurement windows. The attribution may nonetheless conflate TraderTraitor with APT38 or contractor cells operating under looser RGB direction, inflating operational coherence beyond what forensic pattern-matching alone can sustain. A third large RGB-linked DeFi operation is likely within the coming weeks, with cross-chain bridge infrastructure and decentralized-validator attack surfaces the observable targets.

2 sources