Millions of dollars gone in one night: crypto victim of a spectacular North Korean hackers’ attack!

In the ever-changing world of cryptocurrencies, a new major incident has shaken the confidence of investors and platforms. This time, it is KelpDAO, a renowned decentralized platform, that suffered a large-scale attack, losing nearly 293 million dollars vanished in a single night. This spectacular theft, attributed to North Korean hackers, once again illustrates the fragility of the systems underlying the blockchain, despite impressive progress in cybersecurity.

The night of April 18 to 19, 2026 will remain engraved as a dark date for global crypto. It was at this moment that a flaw in the LayerZero bridge was exploited, allowing attackers to manipulate KelpDAO’s transactions. This bridge, designed to ensure inter-blockchain communication, is at the heart of this sophisticated cybercrime, highlighting the risks associated with these indispensable but sometimes vulnerable infrastructures.

Beyond simple hacking, this event also reveals the persistent involvement of cybercriminal groups linked to state regimes, particularly North Korean. The Lazarus Group, already notoriously known for its past attacks, is suspected to be behind this operation. With a history of massive thefts exceeding billions of dollars, this organization illustrates how cryptocurrency is used to fuel military and geopolitical programs, adding a complex layer to the fight against these digital threats.

While KelpDAO and its partners strengthen their defenses, this attack raises a crucial question: will decentralization and technological innovations be enough to protect the millions of dollars invested in this ecosystem, or are we facing an era where cybersecurity must imperatively adapt to increasingly determined and sophisticated adversaries?

Critical flaw in the LayerZero bridge: how North Korean hackers bypassed KelpDAO’s cybersecurity

The success of this attack largely relies on exploiting a technical vulnerability in the LayerZero bridge. This component is essential for interconnecting multiple blockchains, allowing digital assets to flow smoothly between them. However, this interoperability comes with a complexity that can sometimes leave gaps.

In the case of KelpDAO, the hackers injected a fake message into the system. This message was validated by the protocol without thorough verification, thus opening a wide door to manipulate transactions. This highlights a recurring problem in blockchain bridge cybersecurity: the absence of multiple and robust controls.

The usual protection mechanisms implemented by KelpDAO were not sufficient against this attack. Despite elaborate security protocols, the bridge validated a fraudulent message, allowing hackers to divert about 116,500 rsETH, equivalent to 293 million dollars. This flaw is not an isolated case: blockchain bridges are ranked among the most sensitive infrastructures in the crypto sector, often targeted by similar attacks.

Why LayerZero bridges remain a preferred target?

Bridges like LayerZero play a pivotal role in the adoption and development of decentralized finance (DeFi). They facilitate cross-chain transfers, bringing flexibility and speed to transactions. Yet, this versatility complicates security:

• Complex interoperability: Each involved blockchain requires a validation protocol, creating multiple entry points for hackers.
• Often decentralized validation: The decentralized community can make sanctions and corrections difficult and slow.
• Lack of reinforced verifications: As in this case, fake messages can be validated if they do not go through rigorous processes.

In short, the agility offered by bridges comes with significant risks, making the sector’s cybersecurity critical and fragile.

The major consequences of the attack on KelpDAO: a shockwave in global cryptocurrency

The attack targeting KelpDAO is not limited to a simple financial loss. It caused a real shockwave within the crypto ecosystem, highlighting the vulnerability of decentralized platforms to sophisticated attacks. The leak of millions of disappeared dollars also deeply harms investor confidence, already shaken by several previous incidents.

Since the discovery of abnormal movements in KelpDAO’s blockchain, teams have immediately paused several contracts, notably those linked to the rsETH token. This rapid reaction aims to prevent the problem from spreading to the main and secondary networks, especially Layer 2 (L2) where several contracts are active.

Loan protocols like Compound, Euler, and Aave had to strengthen their security measures, demonstrating how a flaw, even localized, can have a domino effect. This phenomenon also reveals the intrinsically interconnected nature of DeFi platforms.

Table: Impact of the attack on various decentralized finance actors

Actor	Type of service	Measures taken	Immediate consequences
KelpDAO	DeFi Platform	Pause of rsETH contracts Investigation ongoing	Loss of 293 million dollars Reputation impacted
LayerZero	Inter-chain bridge infrastructure	Collaboration with KelpDAO Security audit	Criticism over security configuration Need for improvements
Compound, Euler, Aave	DeFi lending protocols	Strengthening protections Increased vigilance	Prevention of propagation User concerns

Since the attack, questions abound about real responsibility: should KelpDAO or LayerZero be blamed? While the latter points to insufficient configuration on the platform side, KelpDAO rejects this version, affirming that the failures stem from the bridge’s very infrastructure. This debate highlights the difficulties in clearly defining responsibilities regarding cybersecurity in such a decentralized and complex universe.

Lazarus, the worrying signature behind this spectacular North Korean hacker attack

The leads quickly converge towards a known actor: the Lazarus Group. This collective of hackers, suspected of being linked to the North Korean regime, is feared for its pronounced expertise in hacking crypto platforms. Their modus operandi has become a benchmark in organized cybercrime, notably serving state interests.

Over the years, Lazarus has amassed an impressive record of attacks with prestigious targets such as Ronin Network, Bybit, Bitrefill, or Drift Protocol. In 2025 alone, this group would be responsible for stealing more than two billion dollars in cryptocurrencies.

How Lazarus finances the North Korean regime’s ambitions through cryptocurrency

The stolen sums are not meant to stagnate in anonymous digital wallets. According to in-depth analyses, including those conducted by the United Nations, amounts diverted by Lazarus directly fund military and technological projects. Cryptocurrency has become an effective channel to circumvent international sanctions, financing:

• The development of nuclear weapons
• Advanced ballistic research
• State cyber-offensive programs
• Clandestine infrastructures

This use of funds from cybercrime puzzles and worries international organizations. It also reveals how cryptocurrency, beyond its image of innovation, can serve interests with major geopolitical implications.

Towards a new era of cybersecurity to counter massive attacks in cryptocurrency?

Faced with increasing attack sophistication, blockchain actors must imperatively evolve. The KelpDAO event serves as a wake-up call in the cryptocurrency world, reflecting the urgent need to rethink cybersecurity standards.

Attack methods often exploit flaws in inter-chain infrastructures, such as bridges, but also human errors in configurations. To respond effectively to these threats, platforms must adopt:

1. Regular and thorough security audits to detect hidden vulnerabilities.
2. Multi-signature validation protocols on sensitive operations to prevent automatic validation of malicious transactions.
3. Active collaboration between infrastructures and decentralized platforms to share information and remedies in real time.
4. Strengthening development standards for blockchain bridges, with the integration of sophisticated control tools.
5. Increased awareness among users and DeFi actors about cybersecurity risks.

This shift towards enhanced security is already underway, but all players in the cryptographic ecosystem will need to unite to prevent millions of dollars from disappearing again, victims of spectacular hacks. Thus, resilience against North Korean hackers, among other threats, will depend on the collective effectiveness in anticipating and neutralizing these attacks.

The question remains open: will the cryptographic revolution truly be able to stand up to the rise of state cybercriminal groups, or will we see more digital fortunes evaporate into the cyber void?