On a quiet Saturday in April, nearly $300 million in digital assets vanished from KelpDAO's holdings — not through chaos, but through precision. Investigators believe North Korea's Lazarus Group, a state-sponsored outfit that has turned cybercrime into a geopolitical instrument, exploited vulnerabilities in LayerZero's blockchain servers to execute what has become 2026's largest known cryptocurrency theft. The act is part of a longer pattern: since 2017, North Korea has allegedly harvested over $3 billion from the digital economy to sustain a nuclear weapons program, turning the borderless pro
North Korean Lazarus Group suspected in $300M crypto heist
No other group globally has the expertise and muscle power to conduct such a hack
Mark
Why does North Korea keep targeting cryptocurrency specifically? Why not banks or government systems?
Mimi
Banks and governments have defenses built up over decades. Cryptocurrency is newer, less regulated, and the money moves across borders instantly. Once they take it, it's nearly impossible to trace or recover. It's the perfect target for a country under sanctions.
Mark
So this $300 million—where does it actually go?
Mimi
Into the regime's coffers. They convert it, move it through exchanges, launder it. The UN estimates they've stolen over $3 billion since 2017. That's real money funding real weapons programs.
Mark
The article mentions LayerZero and KelpDAO. Are these small operations?
Mimi
They're not household names, but they're part of the legitimate cryptocurrency ecosystem. The fact that Lazarus Group can compromise them suggests the entire infrastructure is at risk, not just the small players.
Mark
What does this mean for someone thinking about investing in crypto?
Mimi
It means the risk is real and it's not theoretical. You're not protected the way you would be in a traditional bank. If your assets are on a platform that gets hacked, they're gone. There's no FDIC insurance, no recourse.
Mark
Will this change how these platforms operate?
Mimi
It should. But the irony is that the more security measures you add, the more you move away from the decentralized ideal that attracted people to crypto in the first place. It's a fundamental tension.
El Pulso
- Nearly $300 million was drained from KelpDAO in a single, surgical operation on April 18th — the largest crypto heist recorded so far in 2026.
- Hackers compromised two LayerZero blockchain servers, using them as a direct pipeline into KelpDAO's Ethereum-linked token reserves without triggering alarms until the damage was done.
- Preliminary attribution points firmly to North Korea's Lazarus Group, with one prominent analyst stating no other entity on earth possesses the expertise and resources to execute an operation of this scale.
- LayerZero moved quickly to contain the breach, confirming no other assets or applications on its network were affected — but the $300 million loss to KelpDAO stands.
- The heist lands as a psychological blow to decentralized finance broadly, with experts warning it may frighten new participants away from DeFi platforms at a critical moment for the sector's growth.
On a quiet Saturday in April, nearly $300 million in digital assets vanished from KelpDAO's holdings — not through chaos, but through precision. Investigators believe North Korea's Lazarus Group, a state-sponsored outfit that has turned cybercrime into a geopolitical instrument, exploited vulnerabilities in LayerZero's blockchain servers to execute what has become 2026's largest known cryptocurrency theft. The act is part of a longer pattern: since 2017, North Korea has allegedly harvested over $3 billion from the digital economy to sustain a nuclear weapons program, turning the borderless promise of decentralized finance into a recurring hunting ground. Each heist of this scale asks a quiet but urgent question — what does freedom from institutions cost when there is no institution left to protect you?
On Saturday, April 18th, KelpDAO was robbed of nearly $300 million in cryptocurrency. By Tuesday, the company had issued a statement, and investigators had a strong suspect: North Korea's Lazarus Group, the state-sponsored hacking operation that has spent years systematically raiding digital asset platforms to fund a nuclear weapons program.
The method was precise. Hackers compromised two blockchain servers operated by LayerZero, a technology platform that works in close coordination with KelpDAO. From there, they had a direct line into KelpDAO's holdings — specifically a token pegged to Ethereum — and they drained it cleanly. CoinDesk confirmed it as the largest crypto exploit of 2026. LayerZero's statement offered measured reassurance: the breach had not spread beyond KelpDAO, but what was lost there was substantial.
Henri Arslanian, co-founder of Nine Blocks Capital Management, was unequivocal. "This is clearly the job of North Korea's Lazarus Group," he said. "No other group globally has the expertise and muscle power to conduct such a hack." The scale and cleanliness of the operation — finding the vulnerability, exploiting it, and extracting nearly $300 million before alarms could sound — pointed unmistakably to a state-level actor.
The context makes the pattern undeniable. A UN panel estimated in 2024 that North Korea had stolen more than $3 billion in cryptocurrency since 2017. Just last year, the United States accused the country of orchestrating a $1.5 billion digital asset theft — then the largest in history. This weekend's heist surpassed it.
Beyond the dollar figure, the theft strikes at something foundational. Decentralized finance promises freedom from banks, governments, and gatekeepers — but that freedom leaves users with nowhere to turn when things go wrong. Arslanian put it plainly: the heist will make the DeFi world feel more dangerous to newcomers. In stealing $300 million, North Korea may have also handed a quiet victory to the very institutions that blockchain was built to replace.
On Saturday, April 18th, someone broke into KelpDAO's vault and walked away with nearly $300 million in cryptocurrency. By Tuesday, when the company issued its statement, investigators had a strong suspicion about who did it: North Korea's Lazarus Group, the same outfit that has been systematically plundering digital assets for years to bankroll a nuclear weapons program.
The mechanics of the theft were surgical. Hackers compromised two blockchain servers operated by LayerZero, a cryptocurrency technology platform that works in tandem with KelpDAO. Once inside those servers, they had access to a pipeline that fed directly into KelpDAO's holdings. What they took was a token pegged to Ethereum, one of the world's largest cryptocurrencies. The drain was complete and efficient. CoinDesk, which tracks digital currency news, confirmed this was 2026's biggest crypto heist to date.
LayerZero's statement on Tuesday carried the weight of certainty without quite claiming it. "Preliminary indicators suggest attribution to a highly-sophisticated state actor, likely DPRK's Lazarus Group," the company said, using the initials of North Korea's official name. The company also offered reassurance to its users: the breach had not spread to other assets or applications on the network. The damage was contained to KelpDAO, but the damage was substantial.
Henri Arslanian, who co-founded Nine Blocks Capital Management, had no hedging in his assessment. "This is clearly the job of North Korea's Lazarus Group," he said Wednesday. "No other group globally has the expertise and muscle power to conduct such a hack." The sophistication required to pull off an operation of this scale—to find the vulnerability, exploit it cleanly, and extract nearly $300 million without triggering alarms until it was too late—pointed to a state-level actor with resources and patience.
This is not North Korea's first rodeo. A United Nations panel estimated in 2024 that the country had stolen more than $3 billion in cryptocurrency since 2017. Last year alone, the United States formally accused North Korea of orchestrating a $1.5 billion digital asset theft, which held the record as the largest crypto heist in history until this weekend. The pattern is clear: North Korea has built a sophisticated cybercrime operation, and it uses the proceeds to fund its nuclear weapons development.
What makes this latest heist significant is not just its size but what it signals about the vulnerability of decentralized finance itself. The whole premise of blockchain technology is that it removes the need for middlemen—no banks, no governments, no gatekeepers. But that freedom comes with a cost. When something goes wrong, there is no institution to call, no insurance to claim, no authority to appeal to. Henri Arslanian saw the implications immediately. "This will make it more scary for new entrants to enter the DeFi world," he said. The heist may have just raised the barrier to entry for ordinary people trying to participate in cryptocurrency markets, handing a psychological victory to the very institutions that blockchain was designed to circumvent.
Citas Notables
This is clearly the job of North Korea's Lazarus group. No other group globally has the expertise and muscle power to conduct such a hack.— Henri Arslanian, co-founder of Nine Blocks Capital Management
This will make it more scary for new entrants to enter the DeFi world.— Henri Arslanian, co-founder of Nine Blocks Capital Management
Quieres la nota completa?
Lee el original en The Manila Times ↗
Economy & Finance