North Korea hit crypto for $500M+ this month — and the $6.75 billion threat is not over yet

Piyasa gündeminde öne çıkan haber: In just under three weeks, cyber operatives linked to the Democratic People’s Republic of Korea (DPRK) have stolen more than $500 million from crypto DeFi platforms. This marks a drastic escalation in Pyongyang’s state-sponsored campaign to bankroll its weapons programs through cryptocurrency theft. Drift and KelpDAO drive North Korea's over $500 million DeFi exploits Notably, the twin devastating exploits targeting the Drift Protocol and KelpDAO have pushed North Korea’s illicit crypto haul for the year well past the $700 million mark.

The staggering losses underscore a shift in tactics by Kim Jong Un’s cyber army, which is increasingly weaponizing complex supply-chain vulnerabilities and executing deep-cover human infiltration to bypass standard security perimeters. On April 20, cross-chain infrastructure provider LayerZero confirmed that KelpDAO suffered an exploit resulting in the loss of approximately $290 million. The breach, which occurred on April 18, now stands as the largest single crypto hack of 2026.

Piyasa Dinamikleri

The firm stated that preliminary forensics point directly to TraderTraitor, a specialized cell operating within North Korea's notorious Lazarus Group . Just weeks earlier, on April 1, the Solana-based decentralized perpetual futures exchange Drift Protocol was drained of an estimated $286 million. Blockchain intelligence firm Elliptic swiftly connected the on-chain laundering methodologies, transaction sequencing, and network-level signatures to previously established DPRK attack vectors , noting it was the 18th such incident the firm had tracked this year alone.

Related Reading Compromised developers lying dormant within crypto projects risks next major crypto exploit The bigger risk after Drift may be the access attackers gain before a protocol knows it has a problem. Apr 8, 2026 Gino Matos Exploiting the infrastructure periphery The methodology behind the April attacks reveals a maturation in how state-sponsored hackers target decentralized finance (DeFi). Instead of attacking hardened core smart contracts head-on, operatives are identifying and exploiting the structural periphery.

In the case of the KelpDAO attack , LayerZero explained that the hackers compromised the downstream Remote Procedure Call (RPC) infrastructure utilized by the LayerZero Labs Decentralized Verifier Network (DVN). By poisoning these critical data pathways, the attackers manipulated the protocol’s operations without compromising its core cryptography. LayerZero has since deprecated the affected nodes and fully restored DVN operations, but the financial damage had already been finalized.

Piyasalara Etkisi

This indirect approach highlights a terrifying evolution in cyber warfare. Blockchain security firm Cyvers told that North Korea-linked attackers are showing increased sophistication and investing more resources, both in preparation and execution, to carry out their malicious attacks. The firm added: “We also observe how they consistently find the weakest link.

In this case, it was a third party rather than the protocol's core infrastructure. ” The strategy heavily mirrors traditional corporate cyberespionage and shows that DPRK-linked breaches were becoming harder to stop. Recent incidents, such as the supply-chain compromise of the widely used Axios npm software package, which Google researchers linked to a distinct DPRK threat actor dubbed UNC1069, demonstrate an ongoing, methodical effort to poison the well before the software even reaches the blockchain ecosystem.

North Korea infiltrates crypto workforce Beyond technical exploits, North Korea is currently executing a massive, coordinated infiltration of the global crypto labor market. The threat model has fundamentally shifted from remote hacking campaigns to placing malicious insiders directly onto the payrolls of unsuspecting Web3 startups. A grueling six-month investigation by the Ketman Project, an initiative operating under the Ethereum Foundation’s ETH Rangers security program, recently concluded with startling findings: roughly 100 North Korean cyber operatives are currently embedded inside various blockchain companies.

Blockchain ekosistemindeki bu gelişme, dijital varlık piyasalarını şekillendirmeye devam ediyor. Uzmanlar, konunun yakın vadeli etkilerini mercek altına alıyor.