North Korean hackers suspected in $290 million crypto heist targeting Kelp and LayerZero

North Korean state-sponsored cybercriminals are the primary suspects in a sophisticated $290 million cryptocurrency heist that took place over the weekend of April 18–19, 2026.

 The attack targeted Kelp DAO, a prominent liquid restaking protocol, and exploited infrastructure within the LayerZero messaging network, News.Az reports, citing Sweden Herald.

According to a post-mortem report released on April 20, 2026, the hackers—linked to the TraderTraitor subgroup of the infamous Lazarus Group—managed to "drain" approximately 116,500 rsETH by poisoning verification systems.

The heist was executed with extreme technical precision:

Infrastructure Compromise: The attackers compromised and "poisoned" two Remote Procedure Call (RPC) nodes within LayerZero’s Decentralized Verifier Network (DVN).

Counterfeit Assets: By manipulating these nodes, the hackers minted large quantities of rsETH without providing any actual Ether as collateral.

Laundering via Aave: The stolen assets were quickly moved to the Aave lending protocol, where they were used as collateral to borrow roughly $195 million in genuine wrapped Ether and stablecoins, effectively laundering the funds.

Defensive Sabotage: To ensure the theft's success, the group launched a Distributed Denial-of-Service (DDoS) attack on Kelp’s backup systems to prevent emergency interventions.

While Kelp managed to blacklist the attackers' wallets and block a subsequent attempt to steal an additional $95 million, the initial $290 million remains one of the largest DeFi exploits of 2026. This incident follows a similar $285 million heist on the Drift protocol earlier in April, highlighting a renewed and highly aggressive campaign by North Korean actors to fund state interests through digital asset theft.

News.Az 

By Leyla Şirinova