A notorious North Korean hacking syndicate is believed to be responsible for the theft of nearly $300 million in cryptocurrency over the weekend, marking the largest digital asset heist of 2026 to date.
The exploit targeted the online investment platform KelpDAO on 18 April. According to investigations, the breach occurred after two blockchain servers hosted by the crypto technology application LayerZero were compromised.
This allowed a cryptocurrency token linked to the Ethereum currency to be “drained” from KelpDAO’s vault. In a formal statement on 21 April, LayerZero confirmed that the platform was exploited for approximately $290 million.
“Preliminary indicators suggest attribution to a highly sophisticated state actor, likely DPRK’s Lazarus Group,” LayerZero stated, referring to North Korea’s official name. Despite the scale of the theft, the firm assured users that there was “zero contagion to any other cross-chain assets or applications”.
Henri Arslanian, co-founder of Nine Blocks Capital Management, noted in a communication on 22 April that such massive heists create a “scary” environment for new entrants into decentralised finance (DeFi). DeFi is a concept where blockchain technology is used to conduct financial transactions without traditional intermediaries like banks or government oversight.
“This is clearly the job of North Korea’s Lazarus Group. No other group globally has the expertise and muscle power to conduct such a hack,” Mr Arslanian stated.
The United Nations has previously identified North Korea’s sophisticated cybercrime programme as a significant source of funding for its nuclear weapons development. A UN panel estimated in 2024 that the nation had stolen more than $1.5 billion in digital assets, which was at that time the largest cryptocurrency heist in history.
