Stabble
Summary
Stabble is a Solana-based decentralized exchange (DEX) that specializes in stablecoin liquidity pools. On April 7, 2026, onchain investigator ZachXBT publicly identified the protocol's former CTO, operating under the name Keisuke Watanabe, as an alleged North Korean DPRK IT operative who had also worked at Solana DeFi project ElementalDeFi. Following the disclosure, Stabble's new management team issued an emergency alert urging all liquidity providers to withdraw funds immediately, citing the unquantified risk of planted backdoor code; TVL collapsed 62% within hours and the protocol halted operations pending fresh security audits.
Timeline(9 events)
2024-05-19
Stabble raises $1.44 million private funding round, total funding reaches $2.49 million
DeFiLlama / ICO Drops2026-03-07
Approximate date new management team takes over Stabble operations (approximately four weeks prior to April 7 incident)
Decrypt2026-04-01
Drift Protocol exploited for approximately $285 million in what TRM Labs, Elliptic, and Drift Protocol attributed with medium-to-high confidence to DPRK-linked threat actor UNC4736; attack was the culmination of a six-month social engineering operation
Bloomberg / Elliptic / TRM Labs2026-04-07
ZachXBT publicly identifies Keisuke Watanabe (aliases: kasky53, keisukew53, kdevdivvy, 0xWoo) as an alleged DPRK IT operative, disclosing the individual's connection to ElementalDeFi and Stabble; disclosure includes wallet addresses, email, and OSINT documentation
The Block / Protos / Decrypt2026-04-07
Approximately seven hours after ZachXBT's disclosure, Stabble issues emergency alert at 9:34 a.m. ET urging all liquidity providers to withdraw funds immediately; TVL begins collapsing from approximately $1.75 million
Decrypt / Bitcoin.com News2026-04-07
Stabble TVL collapses 62% within hours, falling from approximately $1.75 million to under $663,000; protocol halts normal operations
Yahoo Finance / Decrypt2026-04-08
Stabble announces comprehensive security audits will be conducted before operations resume; no confirmed exploit disclosed
AllCryptoCurrencyDaily / Metaverse PostDecision Log
- hash: BWTbWQiHsE7pcv8YM1aQt3biKdzrM8vWzXL85pbuwEnR
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 5/22/2026, 4:00:28 PM
last updated: 5/22/2026, 4:00:29 PM
avoid.net — verified advice for a post-truth world