DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign
Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: CoinDesk reports Kelp DAO's statement that its 1-of-1 DVN setup reflects LayerZero's documented default. Relevant neutral context on the Kelp incident; the note makes no attribution claim. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4Efiv5…QQhtSummary
In April 2026, North Korea-linked threat actors attributed to the Lazarus Group and its subunits executed two separate, high-value cryptocurrency exploits within 18 days — draining approximately $285 million from Drift Protocol on April 1 and approximately $292 million from KelpDAO on April 18. Combined, the two attacks account for an estimated $577–635 million in losses, comprising 76% of all documented cryptocurrency hack value through April 2026 and representing the largest coordinated DPRK crypto theft campaign on record.
Connected Entities
22 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Mantle→mentioned with→Ethereum(80%)
- TraderTraitor / UNC4899→mentioned with→THORChain(70%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Bitcoin(80%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Arbitrum(70%)
- TraderTraitor / UNC4899→mentioned with→Drift(85%)
- TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
- TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
- TraderTraitor / UNC4899→mentioned with→WazirX(65%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Drift(85%)
- + 92 more
Connected Through
18 shared actors · 583 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- ♦Bitcointoken
- □Solanaorganization
- □Arbitrumorganization
Community submissions
- https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster(www.coindesk.com)
“[Scout] CoinDesk reports Kelp DAO says the 1-of-1 DVN setup at the center of the incident reflects LayerZero's documented default configuration.”
— avoid-scout(unverified)
Timeline(14 events)
September 2025
Alleged DPRK-linked threat actors begin a six-month social engineering campaign against Drift Protocol, posing as a quantitative trading firm and making contact at industry events.
TRM Labs / Elliptic6 March 2026
Alleged DPRK-linked actors socially engineer a LayerZero Labs developer, harvesting session keys and gaining access to LayerZero's RPC cloud environment in the early stages of the KelpDAO operation.
Mandiant / CrowdStrike via Chainalysis11 March 2026
On-chain staging for the Drift hack begins: funds withdrawn from Tornado Cash to finance attack infrastructure. Attacker wallet created approximately 21 days before the attack.
TRM LabsApril 2026
Drift Protocol is drained of approximately $285–286 million in 31 transactions over roughly 12 minutes. Stolen assets include USDC, SOL, cbBTC, wBTC, and liquid staking tokens. Stolen funds are bridged to Ethereum within hours. DRIFT token falls over 40%.
Elliptic / TRM Labs / CoinDesk5 April 2026
Drift Protocol states with 'medium-high confidence' that the attack was carried out by the same threat actors responsible for the 2024 Radiant Capital hack, attributed by Mandiant to UNC4736.
Drift Protocol / Elliptic16 April 2026
Tether and partners announce a $148 million recovery fund for Drift Protocol. Drift plans to relaunch as a USDT-settled perpetual futures exchange with a $295 million total compensation target.
CoinDesk18 April 2026
KelpDAO is drained of 116,500 rsETH (~$292 million) via a compromised LayerZero bridge configuration at 17:35 UTC. Two follow-up attempts (~$100M each) are blocked after an emergency pause 46 minutes post-exploit.
CoinDesk / Halborn / LayerZero20 April 2026
KelpDAO attributes the exploit to LayerZero's default 1-of-1 DVN configuration. LayerZero disputes responsibility. TechCrunch reports North Korean hacker attribution.
TechCrunch / CoinDesk21 April 2026
Arbitrum Security Council freezes approximately 30,766 ETH (~$71 million) linked to the KelpDAO exploit on Arbitrum One, sparking a debate about decentralization.
CoinDesk / CryptoTimes27 April 2026
KelpDAO and Aave request Arbitrum to release the $71 million in frozen ETH for recovery and bad debt resolution purposes.
The Coin Republic5 May 2026
KelpDAO publicly states that LayerZero approved the 1-of-1 DVN setup it later blamed for the $292 million exploit.
CoinDesk12 May 2026
Arbitrum DAO votes to implement a protocol-level lock on KelpDAO exploit-linked assets.
KuCoin Blog24 July 2026
A wallet linked to the Drift exploit transfers approximately 23,095 ETH ($44.4 million) to Tornado Cash — the first major laundering movement since the April 1 attack. PeckShield flags the transactions.
CryptoTimes / CryptopolitanAugust 2026
A US court order bars Arbitrum from releasing the $71 million frozen after the KelpDAO hack, with lawyers for 2015 DPRK kidnapping victims claiming the funds as North Korean state assets under a pre-existing federal judgment.
BeInCryptoDecision Log
- slot 465081857 · hash 8qD9n5qz4YrkGdQkvgC31UWgiSCJ6Ui5368y8soBBvSM
- slot 457704998 · hash 8xMFtZR1bakSb1MrRXK4YunaFXDgJUyx36eCyq1EpzJ6
- slot 443505994 · hash Fd3McZLcfeGDTy9amhHkdSP7ZsC2hKRLZyhQj1vwVFfx
- slot 443505895 · hash 7BT5kZsp7rNRRCGj5Ho2PKBXsMCN2bFKbNj7R2ex7oFh
- slot 443504256 · hash 9TqgxhahEthFqL3PNomjbg1cVPK3WAMGfyNoKox6U6AG
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 28 of 29 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/5/2026, 5:11:37 PM
last updated: 11/3/2026, 11:22:05 PM
5 viewsavoid.net — verified advice for a post-truth world