$577 million stolen from DeFi in 18 days. Two distinct protocols, two completely different vectors, the same group: Lazarus, North Korea's cyber operations unit. Drift Protocol fell due to a six-month human intelligence operation — conference infiltration, personal relationships, blind signing of pre-arranged transactions. KelpDAO fell due to an attack on bridge infrastructure — poisoned RPC nodes that tricked a single, non-redundant verifier. Neither attack exploited a bug in Solidity or Rust. The smart contracts functioned perfectly. What failed were the people and infrastructure surrounding the code. And that is exactly what the industry doesn't audit.
This article connects both attacks as a coordinated campaign, analyzes why North Korea steals crypto as a state policy, what pattern Lazarus hacks have shared since 2022, and why DeFi's centralized points — signers, bridges, oracles, default configurations — are the real risk no one wants to see.
Editorial note: The attribution to Lazarus/TraderTraitor is preliminary — asserted by Elliptic, TRM Labs, Mandiant, and LayerZero Labs, but not formally confirmed by OFAC, FBI, or Treasury as of April 21, 2026. This article is based on public data from post-mortems, on-chain analysis, and researcher reports. The situation remains fluid.
What do the Drift and KelpDAO hacks have in common?
Apparently, nothing. Drift Protocol ($285M, April 1) was a 6-month social engineering operation against the signers of a multisig on Solana. KelpDAO ($292M, April 18) was a technical attack on the RPC infrastructure of a bridge on Ethereum. Different protocols, different chains, different vectors.
What they share is deeper:
| Pattern | Drift Protocol | KelpDAO |
|---|---|---|
| Initial Funding | Tornado Cash | Tornado Cash |
| Operating Hours | ~9:00 AM Pyongyang time (GMT+9) | Consistent with GMT+9 |
| Actual Target | Multisig signers (people) | Verifier RPC nodes (infra) |
| Code Exploited | None | None |
| Post-theft Laundering | Stablecoin → ETH → mixers | rsETH → Aave borrow → ETH → mixers |
| Attribution | TraderTraitor / UNC4736 (Mandiant) | TraderTraitor (LayerZero) |
Lazarus doesn't repeat tricks — it diversifies vectors. In Drift, it compromised people. In Kelp, it compromised infrastructure. But both attacks targeted the same place: the layer between the code and the real world — signers, oracles, verifiers, configurations. The layer that smart contract audits don't cover.
Why does North Korea steal cryptocurrencies as a state policy?
It's not opportunism — it's national budget. The UN Panel of Experts report (March 2024) documented 58 cyber thefts totaling ~$3 billion between 2017 and 2023, estimating that stolen crypto generates approximately 50% of the DPRK's foreign currency revenue and funds 40% of its weapons of mass destruction program.
In April 2024, Russia vetoed the renewal of that Panel's mandate — eliminating the only international oversight of North Korean cyber thefts. The April 2026 attacks exploit that vacuum.
| Year | DPRK-attributed Thefts | % of Global Total | Notable Attacks |
|---|---|---|---|
| 2022 | ~$1,700M | ~60 % | Ronin Bridge ($625M), Harmony ($100M) |
| 2023 | ~$700M | ~30 % | Atomic Wallet, CoinsPaid, Stake.com |
| 2024 | ~$1,340M | ~61 % | DMM Bitcoin ($305M), WazirX ($235M), Bybit ($1,400M) |
| 2026 (Apr) | $577M | — | Drift ($285M), KelpDAO ($292M) |
| Cumulative | ~$6,750M |
DeFi is the preferred target for three reasons: it offers permissionless laundering rails (DEX, bridges, mixers), signers and verifiers are more vulnerable than the institutional custody of large CEXs, and the industry's audit culture is blind to operational security — it reviews Solidity and Rust, not bridge topology or signer training.
What is the real risk in DeFi — the code or what surrounds the code?
The narrative that "DeFi is insecure because contracts have bugs" is increasingly inaccurate. The two largest hacks of 2026 exploited no bugs. What they exploited were centralized points that the industry treats as operational details:
The centralized points Lazarus attacks
- Multisig signers: Drift had a 2-of-5 multisig with zero timelock. Two signers were tricked into blindly signing pre-arranged transactions with durable nonces. The fragility was not in the code — it was in two humans not understanding what they were signing.
- Bridges with a single verifier: KelpDAO used a 1-of-1 DVN on LayerZero — 47% of LayerZero apps had the same configuration. A single point of failure for billions.
- Manipulable oracles: Drift accepted a fake token (CarbonVote) as collateral because the attacker controlled the price feed. The same pattern as the MCP exploit via prompt injection — the system trusted an input that the attacker controlled.
- Default configurations: Both LayerZero (1-of-1 DVN) and Drift (zero timelock on multisig migration) used insecure defaults. Defaults are convenient — and attackers count on it.
Chainalysis documented that private key and signer compromise accounted for 43.8% of all crypto hacks in 2024. It's not the contracts that fail — it's the people and infrastructure surrounding them.
What defenses would have stopped each attack?
| Defense | Would have stopped Drift | Would have stopped Kelp |
|---|---|---|
| Transaction simulation in hardware wallet | Yes — signers would have seen the admin transfer | Not applicable |
| Mandatory timelock on multisig (24h minimum) | Yes — would have created a detection window | Not applicable |
| Multi-DVN configuration (2-of-3 minimum) | Not applicable | Yes — compromising one verifier would not have been enough |
| Rate limits on bridges (cap per block) | Not applicable | Yes — would have limited the drain to a fraction |
| Diversity of RPC providers in verifiers | Not applicable | Yes — failover within a single provider was the flaw |
| Whitelisting of collateral not modifiable by admin | Yes — the fake CVT token could not have been listed | Not applicable |
None of these defenses are exotic. Timelocks have existed since Compound V1. Multi-DVN is a LayerZero option that 53% of its apps already use. Transaction simulation is a feature of Blockaid and Rabby that costs zero. What's missing isn't technology — it's operational discipline.
Why was the industry's response so slow?
Drift was hacked on April 1. KelpDAO on April 18. In between, the industry had 17 days to harden bridges and review signer configurations. It didn't. 47% of LayerZero apps were still on 1-of-1 DVN when Kelp fell.
The post-Kelp response was more aggressive out of necessity: Lido, Ethena, Ether.fi, Curve, Morpho, Kamino, and over 20 protocols paused LayerZero bridges. Aave lost its #1 position in DeFi by TVL after $5.4 billion in withdrawals. The 2025 security report already warned that bridges were the dominant vector — but inertia is powerful.
The sanctions part is even more frustrating. The U.S. lifted sanctions on Tornado Cash in March 2025 (after the Fifth Circuit ruling limited OFAC's authority over autonomous code). Tornado Cash was used to fund both April 2026 attacks. As of April 21, there is no OFAC designation of the Drift or Kelp attacker wallets.
What does this mean for those with funds in DeFi?
Lazarus is not going to stop. Its operational capacity has grown: in 2023-2024, it executed one large operation every few months. In April 2026, it executed two complex operations with different vectors in 18 days. The next wave will target signers and verifier infrastructure of larger protocols.
What you can do as a user:
- Understand your points of failure. If you have bridged tokens (rsETH on L2, bridged USDC, any wrapped token), your risk includes the bridge's configuration — not just the token contract. The base of your fragility pyramid may depend on a verifier that no one audited.
- Diversify across native chains. ETH on Ethereum mainnet does not depend on a bridge. rsETH bridged to Arbitrum does. The difference is an additional point of failure that most interfaces don't show.
- Monitor the protocols where you have funds. If a protocol migrates signers without a timelock, or uses a bridge with a 1-of-1 configuration, it's a risk signal that justifies moving funds sooner, not later.
- Don't assume "audited" means "secure." Drift and Kelp had multiple audits. The contracts were fine. What failed was outside the scope of any code audit.
- Self-custody protects against exchanges, not against bridges. Having your keys doesn't protect you if your tokens are in a protocol that relies on centralized infrastructure to function.
The lesson of the $577 million: DeFi has spent five years hardening smart contracts with audits, formal verification, and bug bounties. Lazarus has correctly read the ecosystem and moved upstream — to the layers where those defenses don't reach. Until the industry treats blind signing, timelock-less migrations, insecure bridge defaults, and supply chain hygiene as protocol risks — not as operational details — the $577 million in 18 days is a floor, not a ceiling.
Do you know how many of your tokens depend on a bridge to exist?
CleanSky shows your exposure by chain and protocol — so you can see where a centralized point of failure might affect your funds. Without custodying your assets. Discover how it works.