North Korea's $577M DeFi Blitz: Drift and Kelp Hacked in 18 Days

North Korean state-affiliated hackers have executed two of the largest decentralized finance exploits in history within a single month, draining a combined total of over $577 million from Drift Protocol and Kelp DAO. Blockchain analytics firms, cross-chain infrastructure providers, and independent security researchers have attributed both attacks — with varying degrees of confidence — to hacking units operating under the North Korean state apparatus, marking what analysts describe as an escalating, coordinated campaign against DeFi infrastructure.

The Drift Protocol Exploit: A Six-Month Infiltration

On April 1, 2026, attackers drained approximately $285 million from Drift Protocol — the largest decentralized perpetual futures exchange on Solana — in what became the biggest DeFi hack of the year at that point and the second-largest exploit in Solana's history, behind only the $326 million Wormhole bridge hack in 2022.

Drift's post-mortem described the attack as "six months in the making," attributing it with medium confidence to UNC4736, a North Korean state-sponsored threat actor also tracked as AppleJeus, Citrine Sleet, and Gleaming Pisces — a group with a documented history of targeting the cryptocurrency sector since at least 2018.

The attack vector was not a smart contract bug. Instead, it combined social engineering, governance manipulation, and a purpose-built fake token:

• Between December 2025 and January 2026, operatives posing as a quantitative trading firm onboarded an Ecosystem Vault on Drift, submitted strategy documentation, and deposited over $1 million of their own capital to build credibility.
• The attacker manufactured a fictitious token called CarbonVote (CVT), seeded with minimal liquidity and fake trading volume, then manipulated Drift's oracles into treating it as valid collateral.
• Between March 23 and 30, the attacker obtained 2-of-5 multisig approvals from Drift's Security Council members by tricking them into pre-signing malicious transactions using Solana's durable nonce feature, which allowed the authorizations to sit dormant until execution day.
• When triggered on April 1, the vaults were emptied in roughly 12 minutes, with most stolen funds bridged to Ethereum within hours.

The DRIFT token fell over 40% following the exploit, and the protocol's total value locked collapsed from approximately $550 million to under $250 million. A dozen Solana protocols with Drift dependencies paused operations.

The Kelp DAO Exploit: Infrastructure Poisoning at Scale

On April 18, Kelp DAO — a liquid restaking protocol routing user ETH through EigenLayer — fell victim to a $292 million exploit, confirmed as the work of the North Korean state-backed Lazarus Group, specifically its TraderTraitor subunit. This surpassed Drift to become the largest single DeFi exploit of 2026.

Attackers compromised two RPC nodes that LayerZero's verifier relied upon to confirm cross-chain transactions, replacing the node software with malicious versions that reported false data. They then launched a distributed denial-of-service attack against the remaining honest nodes, forcing a failover to the compromised endpoints — tricking LayerZero's verifier into approving a fraudulent cross-chain transaction and releasing 116,500 rsETH to the attackers.

LayerZero attributed the breach partly to Kelp's own security configuration: the protocol ran a 1-of-1 verifier setup, meaning LayerZero Labs was the sole entity verifying messages to and from the rsETH bridge — a configuration LayerZero says it had previously warned against.

The contagion spread quickly across the DeFi sector:

• The April 18 exploit triggered a $10 billion outflow from Aave amid concerns over potential bad debt.
• Total value locked across DeFi fell approximately 7% in the 24 hours after the attack, declining from roughly $99.5 billion to $86.3 billion.
• Several DeFi teams, including Ethena, ether.fi, Tron DAO, and Curve Finance, paused their LayerZero omnichain fungible token bridges in response.

A Shifting and Escalating Threat

The same North Korean unit has now drained more than $577 million from DeFi in 18 days through two structurally different attack vectors: social engineering governance signers at Drift, and poisoning infrastructure RPCs at Kelp.

Analysts note the Kelp exploit signals that North Korea's Lazarus Group is evolving beyond isolated hacks, rapidly shifting tactics from social engineering to exploiting structural weaknesses in crypto infrastructure — suggesting a sustained, state-driven campaign rather than one-off incidents.

If the DPRK attribution holds across both incidents, this would push the regime's confirmed crypto theft total for 2026 past $600 million, proceeds the U.S. government has previously linked to Pyongyang's weapons programs.

LayerZero has since announced it will no longer sign messages for any project operating a 1-of-1 verifier configuration and is accelerating migrations to multi-DVN setups. Security researchers and protocol developers are urging the broader DeFi industry to treat governance timelocks, oracle defense-in-depth, and cross-chain verification redundancy as non-negotiable baseline requirements — not optional configurations.

Published by Coinplurk.com