← DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaignreviewed 2026-10-16 · 34 claims checked
Fact-check findings
What an automated fact-checker found when it re-read DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
3 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #21[disputed][awaiting moderator]in section: KelpDAO Hack — April 18, 2026 ($292M)
“On May 12, 2026, the Arbitrum DAO voted to implement a protocol-level lock.”
reviewerOn May 12, 2026, the Arbitrum DAO voted to implement a protocol-level lock on the frozen KelpDAO-linked assetsThe page's sole source for this claim is internally inconsistent (dated before the event it describes) and contradicts two higher-credibility outlets (The Block, Decrypt) that report the opposite outcome: the DAO voted to release, not lock, the funds, around May 7-8 rather than May 12.Proposed correction (not yet applied)On May 8, 2026, the Arbitrum DAO voted to approve releasing the frozen 30,766 ETH to the DeFi United recovery initiative. - #32[disputed][awaiting moderator]in the timeline
“2026-05-12”
reviewerArbitrum DAO votes to implement a protocol-level lock on KelpDAO exploit-linked assets on 2026-05-12 (timeline date field)Same underlying error as the sections[2] and timeline[11].event findings: the cited source's own publication timestamp (archived 2026-04-24) predates the May 12 event it claims to report, and higher-credibility outlets place the actual vote around May 7-8.Proposed correction (not yet applied)2026-05-08 - #33[disputed][awaiting moderator]in the timeline
“Arbitrum DAO votes to implement a protocol-level lock on KelpDAO exploit-linked assets.”
reviewerArbitrum DAO votes to implement a protocol-level lock on KelpDAO exploit-linked assets (timeline event text)This is the most significant factual error found on the page: it inverts the actual outcome of the Arbitrum governance vote. Both the event text and the date need correction; both share this defect group with the sections[2] occurrence.Proposed correction (not yet applied)Arbitrum DAO votes to approve releasing the frozen 30,766 ETH to the DeFi United recovery initiative.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #11[unverifiable][awaiting moderator]in section: Drift Protocol Hack — April 1, 2026 ($285M)
“deposited 500 million CVT as collateral, and used it to withdraw real assets including USDC, SOL, cbBTC, wBTC, and liquid staking tokens from three primary vaults: the JLP Delta Neutral vault (~$155 million in JLP), the SOL Super Staking vault, and the BTC Super Staking vault.”
reviewerAttackers deposited 500 million CVT as collateral and drained three named vaults (JLP Delta Neutral ~$155M, SOL Super Staking, BTC Super Staking)Three credible sources give three different deposited-CVT figures (750M minted / 'hundreds of millions' deposited / ~785M deposited) and conflicting vault-level breakdowns. Could not confirm the page's specific 500 million figure or its named-vault breakdown from any source consulted. - #17[unverifiable][awaiting moderator]in section: KelpDAO Hack — April 18, 2026 ($292M)
“KelpDAO's public acknowledgment came nearly three hours after the initial drain, at 20:10 UTC.”
reviewerKelpDAO's public acknowledgment came nearly three hours after the initial drain, at 20:10 UTCCould not independently confirm or contradict the specific 20:10 UTC acknowledgment time from any source consulted. - #23[unverifiable][awaiting moderator]in section: Funds Movement and Laundering
“then routed approximately $175 million to Bitcoin via THORChain after the Arbitrum Security Council froze $71 million on Arbitrum One”
reviewerThe attacker routed approximately $175 million to Bitcoin via THORChainCould not independently corroborate this specific laundering figure/route from a source outside the page's own citation.
partially supported
6 claimsThe cited evidence supports part of the claim but not all of it.
- #18[partially supported][awaiting moderator]in section: KelpDAO Hack — April 18, 2026 ($292M)
“The stolen rsETH was used as collateral for borrowing over 82,600 ETH (approximately $195 million) from Aave, creating approximately $177 million in bad debt on the platform that continues to compound.”
reviewerStolen rsETH was used to borrow over 82,600 ETH (~$195M) from Aave, creating approximately $177 million in bad debtThe $177 million bad-debt figure traces to a single outlet (KuCoin) and was not independently corroborated by other sources consulted; the underlying borrowing/collateral mechanics are plausible but the page presents a single-source estimate as settled fact. - #20[partially supported][awaiting moderator]in section: KelpDAO Hack — April 18, 2026 ($292M)
“Legal proceedings have further complicated recovery: lawyers representing victims of a 2015 DPRK kidnapping obtained a US court order barring Arbitrum from releasing the frozen funds, claiming them as North Korean state assets under a 2015 judgment against Pyongyang.”
reviewerLawyers representing victims of a 2015 DPRK kidnapping obtained a US court order barring Arbitrum from releasing the frozen funds, claiming them as North Korean state assets under a 2015 judgment (section 2 occurrence)The existence of a US court order blocking release, tied to a 2015 judgment against North Korea, is confirmed by independent reporting (BeInCrypto itself returned 403 to direct fetch, so verified via The Defiant/Decrypt instead). However, those sources describe the underlying litigation as consolidated 'terror-judgment' cases rather than specifically a kidnapping case; the page's narrower 'kidnapping' framing could not be independently confirmed and may oversimplify a broader terrorism-judgment claim. - #24[partially supported][awaiting moderator]in section: Funds Movement and Laundering
“A US court order has since barred release of those funds, pending a legal claim by victims of a 2015 DPRK kidnapping under an existing federal judgment against North Korea.”
reviewerA US court order barred release of frozen funds pending a claim by victims of a 2015 DPRK kidnapping under an existing federal judgment (section 4 occurrence)Same underlying issue as the section[2] occurrence of this claim: order and judgment year confirmed, but the specific 'kidnapping' characterization is unconfirmed by independent sources consulted. - #27[partially supported][awaiting moderator]in section: Broader DPRK Crypto Theft Context
“North Korean-linked actors have been attributed with stealing approximately $2.02 billion across 80 incidents in 2025, a 51% year-over-year increase.”
reviewerNorth Korean-linked actors stole approximately $2.02 billion across 80 incidents in 2025, a 51% year-over-year increaseThe $2.02 billion and 51% year-over-year figures are confirmed verbatim against the page's cited source. The '80 incidents' count could not be verified in any source consulted and conflicts in spirit with other reporting describing a falling attack count alongside rising dollar losses. - #28[partially supported][awaiting moderator]in section: Broader DPRK Crypto Theft Context
“and some estimates citing the $1.5 billion Bybit hack in February 2025, the April 2026 campaign, and prior incidents push the all-time total to approximately $6.75 billion”
reviewerCiting the Bybit hack, the April 2026 campaign, and prior incidents, some estimates push the all-time DPRK crypto theft total to approximately $6.75 billionThe $6.75B figure matches the page's cited source, but that figure appears to predate the April 2026 campaign in the earlier Chainalysis reporting, creating an internal inconsistency: if $6.75B was already the total before April 2026, the true post-campaign cumulative should be closer to $7.3-7.4B. This may be the cited source's own error rather than the page's invention, but the page passes along a confusing and likely understated total without flagging the discrepancy. - #34[partially supported][awaiting moderator]in the timeline
“A US court order bars Arbitrum from releasing the $71 million frozen after the KelpDAO hack, with lawyers for 2015 DPRK kidnapping victims claiming the funds as North Korean state assets under a pre-existing federal judgment.”
reviewerA US court order bars Arbitrum from releasing the $71 million frozen after the KelpDAO hack, with lawyers for 2015 DPRK kidnapping victims claiming the funds (timeline occurrence)Third occurrence of the same partially-supported characterization issue found in sections[2] and sections[4].
confirmed
22 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“draining approximately $285 million from Drift Protocol on April 1 and approximately $292 million from KelpDAO on April 18”
reviewerDrift Protocol lost approximately $285 million on April 1, 2026 and KelpDAO lost approximately $292 million on April 18, 2026Both headline loss figures and dates are corroborated by multiple independent outlets beyond the cited sources. - #2[confirmed][no action needed]in the summary
“comprising 76% of all documented cryptocurrency hack value through April 2026”
reviewerThe two attacks comprised 76% of all documented cryptocurrency hack value through April 2026Accurately scoped; avoids the overstatement risk of reading the TRM headline as a full-year claim. - #3[confirmed][no action needed]in the summary
“Combined, the two attacks account for an estimated $577–635 million in losses”
reviewerCombined, the two attacks account for an estimated $577–635 million in lossesRange is reasonably hedged rather than asserted as fact. - #4[confirmed][no action needed]in section: Overview and Attribution
“The Drift Protocol hack on April 1, 2026, is attributed by TRM Labs, Elliptic, and Chainalysis to North Korean state-linked operators.”
reviewerThe Drift Protocol hack is attributed by TRM Labs, Elliptic, and Chainalysis to North Korean state-linked operatorsConfirmed, though note all three firms frame this as analytics-based attribution, not law-enforcement confirmation — a caveat the page does not spell out. - #5[confirmed][no action needed]in section: Overview and Attribution
“Drift Protocol itself stated with 'medium-high confidence' on April 5 that the attack was carried out by 'the same threat actors responsible for the October 2024 Radiant Capital hack,' which Mandiant attributed to UNC4736 (also known as AppleJeus).”
reviewerDrift stated with medium-high confidence on April 5 that the attacker was the same threat actor behind the October 2024 Radiant Capital hack, attributed by Mandiant to UNC4736/AppleJeusRadiant attribution and naming (UNC4736/AppleJeus) independently verified. - #6[confirmed][no action needed]in section: Overview and Attribution
“The KelpDAO hack on April 18, 2026, is attributed by Mandiant, CrowdStrike, and independent security researchers to the DPRK subunit TraderTraitor, also identified as UNC4899.”
reviewerThe KelpDAO hack is attributed by Mandiant, CrowdStrike, and independent researchers to DPRK subunit TraderTraitor/UNC4899Closely matches the primary incident report's own language. - #7[confirmed][no action needed]in section: Overview and Attribution
“Pre-attack funding for both operations has been traced in part to wallets linked to prior DPRK laundering networks, including connections to Wu Huihui, a Chinese broker indicted for laundering Lazarus Group proceeds, via 2018-era Bitcoin wallets.”
reviewerPre-attack funding traced in part to Wu Huihui, a Chinese broker indicted for laundering Lazarus Group proceeds, via 2018-era Bitcoin walletsConfirmed by both the cited TRM source and independent reporting on Wu's indictment. - #8[confirmed][no action needed]in section: Overview and Attribution
“The cumulative DPRK crypto theft total since 2017 now exceeds $6 billion in attributed incidents.”
reviewerCumulative DPRK crypto theft total since 2017 now exceeds $6 billionConfirmed. - #9[confirmed][no action needed]in section: Drift Protocol Hack — April 1, 2026 ($285M)
“A total of 31 withdrawal transactions were executed in roughly 12 minutes.”
reviewerA total of 31 withdrawal transactions were executed in roughly 12 minutes during the Drift hackConfirmed word-for-word against primary source. - #10[confirmed][no action needed]in section: Drift Protocol Hack — April 1, 2026 ($285M)
“The attack is the largest DeFi exploit of 2026 and the second-largest in Solana history, behind only the $326 million Wormhole bridge hack of 2022.”
reviewerThe Drift hack is the largest DeFi exploit of 2026 and second-largest in Solana history, behind the $326M Wormhole hack of 2022Confirmed. - #12[confirmed][no action needed]in section: Drift Protocol Hack — April 1, 2026 ($285M)
“As of July 2026, the attacker moved approximately $44.4 million (23,095 ETH) through Tornado Cash, the first significant fund movement in three months.”
reviewerThe attacker moved approximately $44.4 million (23,095 ETH) through Tornado Cash as of July 2026, the first significant fund movement in three monthsConfirmed; minor one-day date variance exists across secondary outlets but not in the cited source. - #13[confirmed][no action needed]in section: Drift Protocol Hack — April 1, 2026 ($285M)
“Tether and partners announced a $148 million recovery fund on April 16, 2026, with Drift set to relaunch as a USDT-settled exchange; the broader $295 million compensation strategy is structured as a revenue-sharing credit mechanism linked to future trading fees.”
reviewerTether and partners announced a $148 million recovery fund on April 16, 2026; Drift set to relaunch as a USDT-settled exchange with a $295 million compensation targetConfirmed across multiple independent outlets. - #14[confirmed][no action needed]in section: KelpDAO Hack — April 18, 2026 ($292M)
“On April 18, 2026, at 17:35 UTC, attackers drained 116,500 rsETH — valued at approximately $292 million — from KelpDAO's LayerZero-powered cross-chain bridge.”
reviewerOn April 18, 2026 at 17:35 UTC, attackers drained 116,500 rsETH (~$292 million), ~18% of rsETH's circulating supply of 630,000 tokensConfirmed. - #15[confirmed][no action needed]in section: KelpDAO Hack — April 18, 2026 ($292M)
“The root cause was KelpDAO's use of a 1-of-1 DVN (single signer verification) configuration on its LayerZero bridge, where a single node was responsible for verifying cross-chain messages before releasing funds.”
reviewerRoot cause was KelpDAO's 1-of-1 DVN (single signer verification) configuration on its LayerZero bridgeConfirmed directly against the primary incident report. - #16[confirmed][no action needed]in section: KelpDAO Hack — April 18, 2026 ($292M)
“Two follow-up attempts at 18:26 and 18:28 UTC, each targeting approximately 40,000 additional rsETH (~$100 million), were blocked after KelpDAO initiated an emergency pause 46 minutes post-exploit at 18:21 UTC.”
reviewerTwo follow-up attempts at 18:26 and 18:28 UTC (~40,000 rsETH/~$100M each) were blocked after an emergency pause 46 minutes post-exploit at 18:21 UTCConfirmed. - #19[confirmed][no action needed]in section: KelpDAO Hack — April 18, 2026 ($292M)
“The Arbitrum Security Council froze approximately 30,766 ETH (~$71 million) linked to the exploit on Arbitrum One on April 21, 2026, triggering a governance debate about decentralization.”
reviewerThe Arbitrum Security Council froze approximately 30,766 ETH (~$71 million) linked to the exploit on Arbitrum One on April 21, 2026Confirmed; minor date variance (April 20 vs 21) exists across secondary sources but matches the page's own cited source. - #22[confirmed][no action needed]in section: Attack Methods — Social Engineering and Infrastructure Compromise
“Both attacks involved sustained pre-positioning — Drift staging began on March 11 and the KelpDAO infiltration began on March 6 — suggesting coordinated DPRK operational planning across both targets simultaneously.”
reviewerDrift staging began March 11 and the KelpDAO infiltration began March 6, suggesting coordinated DPRK operational planning across both targets simultaneouslyThe two dates are independently confirmed; the inference of deliberate cross-target coordination is plausible but not directly sourced, so treat that specific inferential clause with some caution even though verdict is confirmed for the underlying dates. - #25[confirmed][no action needed]in section: Recovery Efforts
“anchored by up to $127.5 million from Tether and $20 million from additional partners”
reviewerDrift's $148M package was anchored by up to $127.5 million from Tether and $20 million from additional partnersConfirmed. - #26[confirmed][no action needed]in section: Recovery Efforts
“KelpDAO announced a migration to Chainlink CCIP following the LayerZero exploit.”
reviewerKelpDAO announced a migration to Chainlink CCIP following the LayerZero exploitConfirmed via independent press coverage, which is stronger support than the social-media source cited on the page. - #29[confirmed][no action needed]in section: Broader DPRK Crypto Theft Context
“The FBI has previously linked Lazarus Group to specific large-scale crypto thefts, including the $41 million Stake.com theft in 2023, and has named specific DPRK operators including Park Jin Hyok and Jon Chang Hyok on its most-wanted list.”
reviewerFBI has linked Lazarus Group to the $41 million Stake.com theft in 2023 and named Park Jin Hyok and Jon Chang Hyok on its most-wanted listConfirmed against the cited FBI press release and independent corroboration. - #30[confirmed][no action needed]in section: Broader DPRK Crypto Theft Context
“The T3 Financial Crime Unit — a joint initiative between TRON, Tether, and TRM Labs — has worked to freeze funds linked to DPRK incidents, though its reported success against the April 2026 campaign has not been fully disclosed as of August 2026.”
reviewerThe T3 Financial Crime Unit — a joint initiative between TRON, Tether, and TRM Labs — has worked to freeze funds linked to DPRK incidentsConfirmed; the hedge about non-disclosure is appropriately cautious. - #31[confirmed][no action needed]in section: Governance and Decentralization Implications
“The KelpDAO hack and the Arbitrum Security Council's subsequent decision to freeze $71 million in attacker funds sparked a broad debate within the crypto community about the nature of decentralization and the legitimacy of protocol-level intervention in theft recovery.”
reviewerThe KelpDAO hack and the Arbitrum freeze sparked a broad debate about decentralization and the legitimacy of protocol-level interventionConfirmed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.