LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor

LayerZero says preliminary indicators point to North Korea’s Lazarus Group, specifically the TraderTraitor subgroup, as the likely actor behind the KelpDAO exploit on April 18, 2026.

The theft now ranks as the largest decentralized finance (DeFi) loss of 2026. It overtakes the $285 million Drift Protocol breach from April 1, which investigators also tied to state-backed North Korean actors.

North Korea Suspected in The Biggest Crypto Loss of 2026

In a post on X (formerly Twitter), LayerZero outlined the mechanics of the incident, describing it as a “highly sophisticated attack.”

“On April 18, 2026, LayerZero Labs’ DVN became the target of a highly sophisticated attack, likely attributable to the Lazarus Group, more specifically TraderTraitor.” the post read. “The attack was specifically engineered to manipulate or poison downstream RPC infrastructure by compromising a quorum of the RPCs the LayerZero Labs DVN relied upon to verify transactions. It was not done through an exploit to the protocol, DVN, key management, or other means.”

The attribution aligns with a broader trend of increasingly complex cyber operations tied to North Korean actors. Earlier this month, Drift Protocol (DRIFT) revealed that its $285 million exploit on April 1 followed a six-month campaign also linked to state-backed entities.

US authorities have previously connected the same group to major incidents, including the $1.5 billion Bybit hack in February 2025. Data from Chainalysis further highlights the scale of the threat.

The firm revealed that North Korea-linked hackers stole a record $2.02 billion from crypto platforms in 2025, a 51% increase year-over-year, largely driven by the Bybit breach.

Follow us on X to get the latest news as it happens

Market Fallout Spreads Across DeFi

Trust across the DeFi sector has taken a visible hit since the breach. Lookonchain reported that Aave’s total value locked (TVL) fell to $17.947 billion, shedding $8.45 billion over the prior two days.

However, DeFi-wide exposure proved larger. Combined TVL across all chains slid from $99.497 billion to $86.286 billion, a $13.21 billion decline.

Aave’s native token AAVE dropped 3.84% in the past 24 hours after losing roughly 20% on Sunday. BeInCrypto highlighted that whales offloaded more than $6 million in tokens after the KelpDAO exploit.