North Korea's DeFi playbook shifts from code exploits to social engineering as Drift and Kelp losses near $560M in 2026
Coindesk •
Revision history
2 recorded changes
Want your article here?
Promote with Leviathan NewsCoinDesk ties recent DeFi exploits — $270M from Drift (April 1) and $292M from Kelp DAO (April 18) — to a North Korean shift from scanning vulnerable contracts to scanning vulnerable people. The Drift hit was a six-month op where operatives posed as a quant firm, deposited $1M of their own capital, onboarded an Ecosystem Vault, then compromised an admin key to drain five vaults. Chainalysis pegs 2025 North Korean crypto theft at $2.02B, and Q1 2026 alone saw 18 attacks and $300M+ stolen. Takeaway: Lazarus is bringing intelligence-agency patience to DeFi, and teams without rigorous counterintelligence are the soft target.
TLDR by @Benthic
More coverage
- North Korea Aggressively Targeting Crypto Industry with Well ... (ic3.gov)
- Crypto & social engineering: North Korean APTs in 2024 - CyberProof (cyberproof.com)
- North Korean Hackers Use Six-Month Social Engineering Campaign ... (iansresearch.com)
- North Korea-linked actor targets Web3 execs in social-engineering ... (cybersecuritydive.com)
- UNC1069 Targets Cryptocurrency Sector with New Tooling and AI ... (cloud.google.com)
Explore the topic
More on Exploit
Cascade restores 100% of CLS user balances after recovering funds from $1.34M exploit
𝕏/@cascade_xyz ·
Cross-chain exploits drain over $35M from AFX, Verus and B² Network in six hours, exposing bridge key compromises, validation flaws and governance weaknesses
Coindesk ·
Verus Ethereum bridge drained of $7.5 million in exploit via import function
𝕏/@blockaid_ ·
AFX bridge exploit drains $24.15 million in USDC on Arbitrum, Blockaid says
𝕏/@blockaid_ ·
Balance Coin ($BLC) collapses 99% after suspected 42DAO exploit causes $915K loss on BNB Chain
𝕏/@PeckShieldAlert ·
Allbridge Core pauses after $1.1M Solana flash-loan exploit manipulates USDC/USDT pool
𝕏/@Allbridge_io ·
Cascade restores 100% of CLS user balances after recovering funds from $1.34M exploit
𝕏/@cascade_xyz ·
Cross-chain exploits drain over $35M from AFX, Verus and B² Network in six hours, exposing bridge key compromises, validation flaws and governance weaknesses
Coindesk ·
Verus Ethereum bridge drained of $7.5 million in exploit via import function
𝕏/@blockaid_ ·
AFX bridge exploit drains $24.15 million in USDC on Arbitrum, Blockaid says
𝕏/@blockaid_ ·
Balance Coin ($BLC) collapses 99% after suspected 42DAO exploit causes $915K loss on BNB Chain
𝕏/@PeckShieldAlert ·
Allbridge Core pauses after $1.1M Solana flash-loan exploit manipulates USDC/USDT pool
𝕏/@Allbridge_io ·