Skip to main content
AVOID.NET
Sign in

DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign

avoid.net/dprk-lazarus-april-2026-635m-blitz-drift-kelp-combined-campaign→0/100·87% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·4Efiv5…QQht

Summary

In April 2026, North Korea-linked threat actors attributed to the Lazarus Group and its subunits executed two separate, high-value cryptocurrency exploits within 18 days — draining approximately $285 million from Drift Protocol on April 1 and approximately $292 million from KelpDAO on April 18. Combined, the two attacks account for an estimated $577–635 million in losses, comprising 76% of all documented cryptocurrency hack value through April 2026 and representing the largest coordinated DPRK crypto theft campaign on record.

Connected Entities

22 entities · 60 linked investigations
Organizations
□TraderTraitor / UNC48990□Chainlink67□Patrick Yarmoch (FBI Agent — Crypto Theft)□Ethereum□Drift□THORChain□Tether□Arbitrum□KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus□Citrine Sleet / AppleJeus□LayerZero Labs□WazirX□Wormhole□Mantle□Solana□Wormhole Bridge□Scroll
Protocols
⌂Drift Protocol⌂LayerZero — DVN Single-Verifier Configuration Risk
Tokens
♦CarbonVote Token♦Bitcoin♦DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign
Relationships
  • Ethereum→mentioned with→Bitcoin(60%)
  • Mantle→mentioned with→Ethereum(80%)
  • TraderTraitor / UNC4899→mentioned with→THORChain(70%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Bitcoin(80%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Arbitrum(70%)
  • TraderTraitor / UNC4899→mentioned with→Drift(85%)
  • TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
  • TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
  • TraderTraitor / UNC4899→mentioned with→WazirX(65%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Drift(85%)
  • + 92 more
Also appears in
Atomic Wallet Hack·0Kelp·18Coldcard Firmware Exploit (2026)·10LayerZero Protocol·55Q2 2026 DeFi Record Hack Wave·0Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0WOO X·38Harmony Horizon Bridge·4DPRK·0Cheil Credit Bank·0+ 50 more

Connected Through

18 shared actors · 585 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign?

Timeline(14 events)

September 2025

Alleged DPRK-linked threat actors begin a six-month social engineering campaign against Drift Protocol, posing as a quantitative trading firm and making contact at industry events.

TRM Labs / Elliptic

6 March 2026

Alleged DPRK-linked actors socially engineer a LayerZero Labs developer, harvesting session keys and gaining access to LayerZero's RPC cloud environment in the early stages of the KelpDAO operation.

Mandiant / CrowdStrike via Chainalysis

11 March 2026

On-chain staging for the Drift hack begins: funds withdrawn from Tornado Cash to finance attack infrastructure. Attacker wallet created approximately 21 days before the attack.

TRM Labs

April 2026

Drift Protocol is drained of approximately $285–286 million in 31 transactions over roughly 12 minutes. Stolen assets include USDC, SOL, cbBTC, wBTC, and liquid staking tokens. Stolen funds are bridged to Ethereum within hours. DRIFT token falls over 40%.

Elliptic / TRM Labs / CoinDesk

5 April 2026

Drift Protocol states with 'medium-high confidence' that the attack was carried out by the same threat actors responsible for the 2024 Radiant Capital hack, attributed by Mandiant to UNC4736.

Drift Protocol / Elliptic

16 April 2026

Tether and partners announce a $148 million recovery fund for Drift Protocol. Drift plans to relaunch as a USDT-settled perpetual futures exchange with a $295 million total compensation target.

CoinDesk

18 April 2026

KelpDAO is drained of 116,500 rsETH (~$292 million) via a compromised LayerZero bridge configuration at 17:35 UTC. Two follow-up attempts (~$100M each) are blocked after an emergency pause 46 minutes post-exploit.

CoinDesk / Halborn / LayerZero

20 April 2026

KelpDAO attributes the exploit to LayerZero's default 1-of-1 DVN configuration. LayerZero disputes responsibility. TechCrunch reports North Korean hacker attribution.

TechCrunch / CoinDesk

21 April 2026

Arbitrum Security Council freezes approximately 30,766 ETH (~$71 million) linked to the KelpDAO exploit on Arbitrum One, sparking a debate about decentralization.

CoinDesk / CryptoTimes

27 April 2026

KelpDAO and Aave request Arbitrum to release the $71 million in frozen ETH for recovery and bad debt resolution purposes.

The Coin Republic

5 May 2026

KelpDAO publicly states that LayerZero approved the 1-of-1 DVN setup it later blamed for the $292 million exploit.

CoinDesk

12 May 2026

Arbitrum DAO votes to implement a protocol-level lock on KelpDAO exploit-linked assets.

KuCoin Blog

24 July 2026

A wallet linked to the Drift exploit transfers approximately 23,095 ETH ($44.4 million) to Tornado Cash — the first major laundering movement since the April 1 attack. PeckShield flags the transactions.

CryptoTimes / Cryptopolitan

August 2026

A US court order bars Arbitrum from releasing the $71 million frozen after the KelpDAO hack, with lawyers for 2015 DPRK kidnapping victims claiming the funds as North Korean state assets under a pre-existing federal judgment.

BeInCrypto
Provenance & Audit Trail
Anchored on SolanaVerify on-chain28 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 28 of 29 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 8/5/2026, 5:11:37 PM

last updated: 8/18/2026, 11:44:37 PM

4 views

avoid.net — verified advice for a post-truth world