Lazarus Group

The Democratic People's Republic of Korea (DPRK), operating primarily through state-sponsored hacking units designated as the Lazarus Group, TraderTraitor, and APT38, has stolen an estimated $6.75 billion in cryptocurrency since 2016 across dozens of major exploits. These operations are attributed by the FBI, OFAC, CISA, and allied governments to North Korea's Reconnaissance General Bureau and are conducted to fund the regime's weapons of mass destruction and ballistic missile programs in circumvention of international sanctions. DPRK-linked hackers are responsible for the largest single crypto theft in history — the $1.5 billion Bybit hack in February 2025 — and continue to operate at unprecedented scale and sophistication.

KelpDAO is a liquid restaking protocol that issues rsETH, launched in late 2023 by the team behind Stader Labs. In April 2026 its LayerZero-based rsETH bridge was exploited for roughly $292 million (116,500 rsETH); LayerZero preliminarily attributed the attack to North Korea's Lazarus Group (TraderTraitor), and TRM Labs also attributes it to a North Korean actor. Kelp and LayerZero publicly dispute responsibility for the bridge configuration, and a DeFi-industry recovery effort (DeFi United) restored rsETH backing within weeks while a legal claim over frozen funds remained unresolved in sources found.

Tapioca DAO is an omnichain DeFi money market built on LayerZero, offering a CDP stablecoin (USDO) and isolated lending markets (Singularity/Big Bang) across Arbitrum and BNB Chain. On October 18, 2024, the protocol suffered a critical security breach when a team member was targeted by a social engineering attack attributed to North Korea's Contagious Interview campaign, resulting in private key compromise, drainage of TAP token vesting contracts, and the minting of 5 quintillion USDO. Approximately $4.4–4.7 million was stolen before a partial counter-exploit recovered roughly 996 ETH (~$2.7 million), leaving the protocol treasury down approximately 45% and the TAP token price collapsed over 95%.

Nexera (formerly AllianceBlock) is a blockchain infrastructure protocol focused on compliant real-world asset tokenization, operating primarily on Ethereum. In August 2024, a threat actor later attributed to North Korea's Lazarus Group used social engineering and BeaverTail malware to steal smart contract management credentials, enabling unauthorized transfer of 47.24 million NXRA tokens valued at approximately $1.9 million. The team mitigated further losses by zeroing out and subsequently burning the 32.5 million tokens that remained in the attacker's wallet, limiting confirmed liquidated losses to roughly $449,000.

BitoPro is a Taiwanese centralized cryptocurrency exchange operated by BitoGroup, serving over 800,000 users with TWD (New Taiwan Dollar) fiat on/off-ramps. On May 8, 2025, the exchange suffered an approximately $11.5 million hot wallet theft attributed to North Korea's Lazarus Group via a social-engineering and AWS-token-hijacking attack. The exchange did not publicly disclose the breach for approximately 25 days, only confirming the incident after on-chain investigator ZachXBT flagged suspicious outflows on June 2, 2025.

[MERGED] Consolidated into /garden on 2026-10-26. This page's content is preserved in its history.

WazirX is an Indian cryptocurrency exchange, operated by Zanmai Labs Pvt Ltd under Singapore-registered parent Zettai Pte Ltd, that lost approximately $234.9 million in a July 2024 multisig-wallet exploit later attributed by the governments of the United States, Japan and South Korea to North Korea's Lazarus Group. Beyond the hack itself, the exchange carries a long record of own-conduct risk: a disputed Binance ownership relationship that has complicated victim recovery, a public attribution fight with its former custody provider Liminal, repeated Indian Enforcement Directorate FEMA and money-laundering actions since 2021, and a 15-month freeze on user funds that ended only after a Singapore court approved a revised restructuring plan in October 2025. A Supreme Court of India petition seeking a criminal probe of WazirX's founder was dismissed in April 2025 on jurisdictional grounds, leaving most liability questions unresolved.

Cardano (ADA) is a proof-of-stake blockchain launched in 2017 by Charles Hoskinson and Jeremy Wood, developed through Input Output Global with EMURGO and the Cardano Foundation. A 2025 independent forensic audit found no basis for misappropriation allegations against Hoskinson, and the SEC/CFTC classified ADA as a digital commodity in March 2026. The network has had protocol-level and ecosystem incidents (a November 2025 chain partition, the June 2026 SecondFi wallet exploit) and ADA holders are a recurring target of impersonation, phishing and account-hijack scams.