LayerZero Team Accused North Korea of Hacking KelpDAO

LayerZero Team Accused North Korea of Hacking KelpDAO

Behind the attack on the liquid restaking protocol KelpDAO, which saw attackers siphon off roughly $290 million-$292 million, is likely the North Korean hacking group Lazarus Group — specifically its TraderTraitor subunit, which is often linked to state-backed cyberattacks — according to a statement from LayerZero.

The incident, which occurred on April 18, 2026, has already triggered a chain reaction across the DeFi sector: mass withdrawals from Aave, a drop in the market’s total value locked, and renewed concerns about the security of crosschain infrastructure.

How the Hack Happened and Why Responsibility Is Partly Placed on KelpDAO

According to LayerZero, the attackers carried out a sophisticated attack on the RPC infrastructure used by the DVN node to validate transactions.

The hackers:

  • Compromised two RPC nodes
  • Replaced the binary files that ran the op-geth nodes
  • Carried out RPC request spoofing attacks
  • Simultaneously launched a DDoS attack on unaffected nodes
  • Forced the system to switch to “poisoned” backup RPCs

As a result, the DVN confirmed transactions that never actually happened.

LayerZero emphasized that the compromise did not spread to other assets.

At the same time, the crypto community sharply criticized KelpDAO for choosing a weak architecture without redundant verification. One user, under the handle hendricks, noted that the risk of the 1/1 DVN model had been raised as far back as 15 months ago on the Aave governance forum:

“This wasn’t bad luck — this was a conscious choice. Extremely suspicious.”

Criticism was also directed at LayerZero itself. User Bradly (CryptPlayer) noted:

“It looks like you shift all responsibility to KelpDAO, but actually you share it.”

A similar view was voiced by StarkWare CISO Haim Krasniker, who pointed out a contradiction in the failover mechanism:

“Once that DDoS happened, it should not default to Internal RPCs that are solely controlled by LZ.”

Domino Effect: Aave, Decline in TVL, and Pressure on ETH Liquidity

The most serious secondary hit landed on Aave. After the hack, the rsETH asset was urgently frozen on Aave V3 and V4. This was announced by protocol founder Stani Kulechov.

According to market estimates, the incident has already caused Aave’s TVL to drop to approximately $18 billion due to fears of bad debt.

Analyst Anndy Lian noted that the direct debt of $177 million accounts for just 0.65% of Aave’s total value locked (TVL), estimated at around $27.3 billion, but the biggest pressure is being felt by liquidity providers on Ethereum.

In his words:

“It is currently facing its most severe existential test since inception.”

Recall that the KelpDAO hack was only part of a broader cybersecurity crisis in the crypto industry. According to CertiK, in March 2026 alone, 46 attacks were recorded, the highest figure since November 2024.

In addition, the market has already endured:

  • The hack of Drift for about $280 million
  • An incident involving Stabble due to the possible involvement of a developer linked to North Korea
  • The hack of Hyperbridge, which triggered Polkadot (DOT) to drop to $1.15 after the illicit minting of 1 billion DOT

 

Source: https://incrypted.com/en/layerzero-team-accused-north-korea-of-hacking-kelpdao/

 

 

 

Anndy Lian is an early blockchain adopter and experienced serial entrepreneur who is known for his work in the government sector. He is a best selling book author- “NFT: From Zero to Hero” and “Blockchain Revolution 2030”.

Currently, he is appointed as the Chief Digital Advisor at Mongolia Productivity Organization, championing national digitization. Prior to his current appointments, he was the Chairman of BigONE Exchange, a global top 30 ranked crypto spot exchange and was also the Advisory Board Member for Hyundai DAC, the blockchain arm of South Korea’s largest car manufacturer Hyundai Motor Group. Lian played a pivotal role as the Blockchain Advisor for Asian Productivity Organisation (APO), an intergovernmental organization committed to improving productivity in the Asia-Pacific region.

An avid supporter of incubating start-ups, Anndy has also been a private investor for the past eight years. With a growth investment mindset, Anndy strategically demonstrates this in the companies he chooses to be involved with. He believes that what he is doing through blockchain technology currently will revolutionise and redefine traditional businesses. He also believes that the blockchain industry has to be “redecentralised”.

j j j

Seoul’s Calculated Embrace: Why South Korea’s Crypto Pivot Is a Blueprint—and a Warning

Seoul’s Calculated Embrace: Why South Korea’s Crypto Pivot Is a Blueprint—and a Warning

South Korea has arrived at a decisive turning point in the global digital asset story, one that reflects both the ambitions and anxieties shaping the next phase of crypto’s evolution. For nearly a decade, the country functioned as a peculiar enclave—a retail-dominated “walled garden” defined by feverish speculation, the notorious “Kimchi Premium,” and a regulatory posture that lurched unpredictably between permissiveness and crackdown. That chapter is now closing.

The January decision to lift a nine-year ban on corporate crypto trading, paired with the increasingly assertive enforcement of the Virtual Asset User Protection Act, marks not just a policy shift but a state-directed transformation. South Korea is no longer merely participating in the crypto market; it is attempting to redesign it.

The reopening to institutional players is, at first glance, a watershed moment. By allowing publicly listed companies and professional investors to allocate up to 5 percent of their equity capital annually into digital assets—albeit confined to the top 20 cryptocurrencies by market capitalization and traded on five regulated exchanges—Seoul is channeling substantial capital into the ecosystem. Roughly 3,500 corporations now stand poised to re-enter the market, bringing with them the promise of deeper liquidity and a moderating influence on the retail-driven volatility that has long defined Korean exchanges. If successful, the policy could also erode the persistent arbitrage gaps that have historically separated Korea’s crypto prices from global benchmarks.

From a market-structure standpoint, the approach is undeniably cautious, even conservative. By restricting corporate exposure to established assets such as Bitcoin and Ethereum, regulators aim to shield balance sheets from the turbulence of speculative altcoins. Yet embedded within this prudence is a deeper philosophical tension. The same framework that promotes stability also risks starving smaller, experimental projects of institutional capital. Innovation in the crypto space has often emerged from the margins, from precisely the kinds of ventures now excluded from meaningful funding channels. South Korea has made a clear choice: stability over experimentation, order over dynamism. The consequences of that choice will reverberate well beyond its borders.

Nowhere is the state’s preference for control more evident than in enforcement. The Virtual Asset User Protection Act, in effect since July 2024, has moved decisively from theory to practice. Early 2026 brought the first criminal prosecutions under its provisions, including a February ruling that imposed a three-year prison sentence for a wash-trading scheme that generated roughly 7.1 billion won—about $54.6 million—in illicit gains. Exchanges are now required to maintain continuous, round-the-clock surveillance for “abnormal transactions,” with immediate reporting obligations for suspicious activity. What was once a loosely policed marketplace has become a tightly monitored financial system.

Additional safeguards reinforce this transformation. Service providers must now store at least 80 percent of user assets in offline cold wallets, backed by insurance or reserve funds—a measure that directly addresses the industry’s long history of devastating hacks. Combined with a late-2025 Supreme Court ruling that cryptocurrencies held on exchanges constitute “property” subject to seizure, and the imminent rollout of cross-border reporting requirements, the architecture of oversight is becoming comprehensive. These changes undoubtedly strengthen consumer protection. But they also signal something broader: a level of state visibility that would have been unthinkable in crypto’s earlier, more anarchic phase.

The tightening net becomes even more apparent in the planned expansion of the Travel Rule. By lowering the reporting threshold to encompass nearly all transactions and requiring monthly disclosures of cross-border transfers to the Bank of Korea, regulators are effectively eliminating transactional anonymity. Authorities justify these measures by pointing to the outsized role of arbitrage—particularly the Kimchi Premium—in foreign exchange violations, which they claim account for more than 80 percent of such crimes. The rationale is compelling. Yet the implications are profound. A system designed to eradicate illicit activity risks, in the process, erasing the privacy that once defined the ethos of blockchain technology. The pursuit of transparency, taken to its logical extreme, begins to resemble a surveillance regime.

Against this backdrop, the repeated delay of a 20 percent capital gains tax—now scheduled for January 2027—introduces a curious note of ambiguity. Officials cite unresolved “infrastructure gaps,” including the difficulty of tracking decentralized transactions and defining taxable events such as staking rewards or airdrops. In practical terms, the postponement creates a temporary equilibrium: a market enjoying increasing legitimacy without the immediate burden of taxation. This “Goldilocks” period may prove beneficial in the short term, allowing institutions to acclimate and compliance systems to mature. But it also perpetuates uncertainty, complicating long-term planning for both investors and firms.

The government’s alignment with the OECD’s Crypto-Asset Reporting Framework, expected to be adopted by dozens of countries in 2027, suggests that South Korea is not acting in isolation but as part of a broader international convergence. Whether such frameworks can adequately account for the complexities of decentralized finance remains an open question. The risk, as always, is that intricate technological ecosystems are forced into regulatory templates designed for far more conventional financial instruments. Nuance tends to disappear in translation.

Looking ahead, the proposed Digital Asset Basic Act—expected by late 2026—aims to fill remaining gaps in the regulatory landscape. Its provisions for stablecoins, likely requiring full reserve backing held in banks, reflect a direct response to the trauma of the Terra-Luna collapse. Meanwhile, a separate framework for Security Token Offerings, scheduled for early 2027, seeks to integrate tokenized real-world assets into the existing capital markets regime. These initiatives promise clarity, but they also underscore the complexity of the undertaking. Even well-intentioned measures can produce unintended consequences.

A proposed 34 percent ownership cap for major shareholders in crypto exchanges, designed to prevent monopolistic control, may inadvertently deter the very institutional investment the broader policy framework seeks to attract. At the same time, the staggered rollout of reforms risks creating a prolonged period of regulatory limbo, particularly for emerging sectors that depend on clear rules to innovate.

South Korea’s experiment offers a strikingly dual-edged lesson. On one side lie the benefits: stronger consumer protections, reduced systemic risk, a more stable market structure, and the legitimizing influence of institutional capital. On the other side are the trade-offs, which are no less significant. Rising compliance costs could consolidate the exchange ecosystem into a narrow oligopoly, diminishing competition and limiting consumer choice. The erosion of privacy raises fundamental questions about the balance between security and autonomy. And the deliberate privileging of established assets may entrench incumbents while sidelining the very innovations that have historically driven the sector forward.

What South Korea is attempting is not simply regulation. It is market design. The goal is a crypto ecosystem that is liquid, secure, transparent—and firmly bounded by state oversight. Such a system may well deliver the stability and credibility needed to attract traditional finance. But it also redefines the boundaries of what crypto is meant to be. The world is watching closely, not just to see whether prices stabilize or institutions pile in, but to understand whether a system engineered for control can still nurture the openness and experimentation that gave rise to the technology in the first place.

The blueprint is taking shape in Seoul. The question now is whether it leaves enough room for the future it seeks to govern.

 

Source: https://intpolicydigest.org/seoul-s-calculated-embrace-why-south-korea-s-crypto-pivot-is-a-blueprint-and-a-warning/

Anndy Lian is an early blockchain adopter and experienced serial entrepreneur who is known for his work in the government sector. He is a best selling book author- “NFT: From Zero to Hero” and “Blockchain Revolution 2030”.

Currently, he is appointed as the Chief Digital Advisor at Mongolia Productivity Organization, championing national digitization. Prior to his current appointments, he was the Chairman of BigONE Exchange, a global top 30 ranked crypto spot exchange and was also the Advisory Board Member for Hyundai DAC, the blockchain arm of South Korea’s largest car manufacturer Hyundai Motor Group. Lian played a pivotal role as the Blockchain Advisor for Asian Productivity Organisation (APO), an intergovernmental organization committed to improving productivity in the Asia-Pacific region.

An avid supporter of incubating start-ups, Anndy has also been a private investor for the past eight years. With a growth investment mindset, Anndy strategically demonstrates this in the companies he chooses to be involved with. He believes that what he is doing through blockchain technology currently will revolutionise and redefine traditional businesses. He also believes that the blockchain industry has to be “redecentralised”.

j j j

Binance Founder Changpeng Zhao North Korea’s $1.34B Crypto Theft Tactics

Binance Founder Changpeng Zhao North Korea’s $1.34B Crypto Theft Tactics

Binance co-founder Changpeng Zhao (CZ) has warned that North Korean hackers are using increasingly advanced methods to infiltrate cryptocurrency companies. In a recent X post, CZ explained:

“They exploit trust, creativity, and patience to breach platforms and steal user funds.”

According to Chainalysis, North Korean hackers stole around $1.34 billion in crypto in 2024, with both the U.S. and U.N. confirming that the stolen money is being used to help finance North Korea’s weapons program.

Job Applications as a Trojan Horse in Crypto Security Breaches

One of the most common tactics involves posing as job candidates. CZ wrote:

“Hackers often apply for developer, finance, or security positions. Once hired, they have insider access — a long-term foot in the door for future attacks.”

This strategy allows them to embed themselves in organizations and quietly prepare for larger hacks.

Fake Employers and Malware Hidden in Coding Tests

Another tactic is impersonating employers. During fake interviews on Zoom, attackers create staged technical issues and trick employees into downloading malicious “updates.”

CZ explained:

“In some cases, they send ‘sample code’ for a coding test. That code is secretly malware.”

This turns routine recruitment tasks into high-risk entry points.

Customer Support Exploits in Crypto Exchanges

Hackers also pretend to be regular users seeking help. They send links that look legitimate but redirect to infected pages.

“Once an employee clicks, attackers can steal data or even gain direct access to exchange systems,” CZ warned.

Insider Bribery and Outsourced Service Vulnerabilities

Some hackers bypass technical firewalls altogether by bribing employees or targeting third-party vendors.

CZ pointed to a recent case:

“In India, hackers breached a major outsourced service provider. Critical data from a U.S. exchange leaked — users lost over $400 million.”

Social Engineering Attacks: From Screen Sharing to One-Click Hacks

Crypto investor Anndy Lian added his warning on X:

“Hackers don’t always need files for you to click. Just sharing your screen can give them the access they need.”

CZ agreed, adding that even one-click hacks — like the rumored Jeff Bezos phone breach — prove how dangerous a single link can be.

Community members echoed these concerns. One investor wrote:

“I lost my Instagram account after clicking a link. The hackers took over instantly.”

Lian himself revealed he permanently lost his original Instagram account this way, underscoring how hard recovery is once control is lost.

North Korea’s Lazarus Group and Global Crypto Theft

The Lazarus Group, North Korea’s state-backed hackers, has been behind billions in stolen crypto over the past decade. According to Chainalysis, they stole nearly $1.7 billion in 2022, with hundreds of millions more in 2023 and 2024.

Reports suggest 2025 is already on track to see massive thefts linked to these groups.

CZ ended his post with a clear reminder:

“Stay SAFU. Awareness and discipline are still the best defenses against these persistent threats.”

 

Source: https://coinpedia.org/news/binance-founder-changpeng-zhao-north-koreas-1-34b-crypto-theft-tactics/

Anndy Lian is an early blockchain adopter and experienced serial entrepreneur who is known for his work in the government sector. He is a best selling book author- “NFT: From Zero to Hero” and “Blockchain Revolution 2030”.

Currently, he is appointed as the Chief Digital Advisor at Mongolia Productivity Organization, championing national digitization. Prior to his current appointments, he was the Chairman of BigONE Exchange, a global top 30 ranked crypto spot exchange and was also the Advisory Board Member for Hyundai DAC, the blockchain arm of South Korea’s largest car manufacturer Hyundai Motor Group. Lian played a pivotal role as the Blockchain Advisor for Asian Productivity Organisation (APO), an intergovernmental organization committed to improving productivity in the Asia-Pacific region.

An avid supporter of incubating start-ups, Anndy has also been a private investor for the past eight years. With a growth investment mindset, Anndy strategically demonstrates this in the companies he chooses to be involved with. He believes that what he is doing through blockchain technology currently will revolutionise and redefine traditional businesses. He also believes that the blockchain industry has to be “redecentralised”.

j j j