LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor
LayerZero says preliminary indicators level to North Korea’s Lazarus Group, particularly the TraderTraitor subgroup, because the possible actor behind the KelpDAO exploit on April 18, 2026.
The theft now ranks as the most important decentralized finance (DeFi) lack of 2026. It overtakes the $285 million Drift Protocol breach from April 1, which investigators additionally tied to state-backed North Korean actors.
North Korea Suspected in The Biggest Crypto Loss of 2026
In a submit on X (previously Twitter), LayerZero outlined the mechanics of the incident, describing it as a “highly sophisticated assault.”
“On April 18, 2026, LayerZero Labs’ DVN turned the goal of a extremely refined assault, possible attributable to the Lazarus Group, extra particularly TraderTraitor.” the post learn. “The assault was particularly engineered to manipulate or poison downstream RPC infrastructure by compromising a quorum of the RPCs the LayerZero Labs DVN relied upon to confirm transactions. It was not achieved by means of an exploit to the protocol, DVN, key administration, or different means.”
The attribution aligns with a broader pattern of more and more advanced cyber operations tied to North Korean actors. Earlier this month, Drift Protocol (DRIFT) revealed that its $285 million exploit on April 1 adopted a six-month marketing campaign additionally linked to state-backed entities.
US authorities have beforehand linked the identical group to major incidents, together with the $1.5 billion Bybit hack in February 2025. Data from Chainalysis additional highlights the scale of the threat.
The agency revealed that North Korea-linked hackers stole a file $2.02 billion from crypto platforms in 2025, a 51% improve year-over-year, largely pushed by the Bybit breach.
Follow us on X to get the newest information because it occurs
Market Fallout Spreads Across DeFi
Trust throughout the DeFi sector has taken a visual hit for the reason that breach. Lookonchain reported that Aave’s whole worth locked (TVL) fell to $17.947 billion, shedding $8.45 billion over the prior two days.
However, DeFi-wide publicity proved bigger. Combined TVL throughout all chains slid from $99.497 billion to $86.286 billion, a $13.21 billion decline.
Aave’s native token AAVE dropped 3.84% prior to now 24 hours after shedding roughly 20% on Sunday. BeInCrypto highlighted that whales offloaded greater than $6 million in tokens after the KelpDAO exploit.
The submit LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor appeared first on BeInCrypto.
