Skip to content
OriginalSign in

SecurityWeekIonut Arghire

North Korea linked hackers steal $290M from Kelp DAO DeFi

Part of the TraderTraitor story · since 9 Mar

Developinglatest 20 minutes ago16 articles10 outlets
9 Mar · The Hacker News first5 Jul14 Aug23 SepNowThis article2nd of 16
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi. This article, 2nd of 16.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.

The $290 million Kelp DAO crypto heist has been attributed to North Korea, with the Lazarus Group named as the likely actor and described as a claim by SecurityWeek. The attack occurred at 17:35 UTC on Sunday, draining 116,500 rsETH (restaked ether) valued at roughly $292 million, and was followed by a second attempt that blocked about 40,000 rsETH worth roughly $95 million.

LayerZero’s Decentralized Verifier Network was targeted after attackers poisoned two of its RPCs, enabling a DDoS to trigger a failover to the poisoned nodes and allowing malicious instructions to pass as valid; according to LayerZero, this pivot point enabled an RPC-spoofing attack and a highly sophisticated operation likely mounted by TraderTraitor, a subgroup within Lazarus.

Kelp DAO paused relevant contracts and blacklisted the attackers’ wallet, while Arbitrum Security Council and other partners froze assets in addresses connected to the heist. The incident also coincided with broader market effects, including a near $8 billion drop in Aave’s total value, though Kelp says it is prioritising contagion prevention across DeFi.

How the story developed

All 16 articles
Developinglatest 20 minutes ago16 articles10 outlets

16 articles from 10 outlets since 9 Mar. Picked up again on 29 Oct after 2 weeks quiet. This was the 2nd report, 43 days after the first.

Now9 Mar2528152425 Sep172641119First reportThe Hacker News · 9 Mar, 16:26This article2nd of 16 · day 43
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi. This article, 2nd of 16.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 16 articles as a list
  1. Mon 9 MarDay 01
    1. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds16:26 · The Hacker News · First report

  2. Quiet for 6 weeks

    Tue 21 AprDay 432
    1. North Korea linked hackers steal $290M from Kelp DAO DeFi10:21 · SecurityWeek · Picked up again · This article, 2nd of 16
    2. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit19:27 · Security Affairs

  3. Quiet for 2 days

    Thu 23 AprDay 451
    1. North Korean hackers steal $290m via LayerZero KelpDAO breach15:01 · The Hacker News

  4. Quiet for 8 days

    Fri 1 MayDay 531
    1. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks21:31 · Dark Reading · Picked up again

  5. Quiet for 18 weeks

    Mon 7 SepDay 1821
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  6. Quiet for 2 weeks

    Mon 21 SepDay 1961
    1. Jade Sleet Breach Exposes Backdoors and Rising AI Threats06:21 · The Hacker News · Picked up again

  7. Quiet for 7 days

    Mon 28 SepDay 2031
    1. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests02:30 · SecurityOnline · Picked up again

  8. Quiet for 2 weeks

    Mon 12 OctDay 2171
    1. Fake Terraform AWS provider installs backdoors on developer systems09:11 · SecurityOnline · Picked up again

  9. Quiet for 2 weeks

    Thu 29 OctDay 2341
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again
  10. Fri 30 OctDay 2356
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
    3. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
    Show 3 more from 30 Oct
    1. Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity
    2. Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes
    3. TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in