lazarusgroup

Hey, Binance Square folks!
Continuing our report on the staggering 1,140% surge in cyber attacks in April 2026, one name keeps dominating the headlines: Lazarus Group.
But who are they really? Why are they so obsessed with DeFi? And who do they work for? Let's thoroughly dissect the profile of this hacking group that is now responsible for 76% of global cyber losses this year.
1. Who is the Lazarus Group?
Lazarus Group (also known as APT38) is not some bunch of amateur hackers operating from a basement. They are an elite cyber unit that is highly organized and has military-level training.

April 2026 officially became the "bloodiest" month for the crypto industry. Total losses since the start of the year have already surpassed $800 million, and nearly all of that volume has occurred in the last 30 days.
We're witnessing not just a series of hacks but a systemic crisis in the security of infrastructure and communications.

While markets were watching $79,000 and the Iran ceasefire, something else happened in April that deserves serious attention.Crypto protocols lost over $606 million to hacks in just 18 days of April 2026, making it the worst month since February 2025's Bybit breach. The entire first quarter of 2026 saw $165.5 million in losses across a relatively quiet stretch. April's $606 million total arrived in under three weeks, making the month 3.7 times larger than Q1 combined and pushing 2026's year-to-date theft total to approximately $771.8 million across 47 separate incidents.
Two exploits account for nearly all of it. The $285 million Drift Protocol attack on April 1, later attributed to North Korea's Lazarus Group, and the $292 million KelpDAO breach on April 18, also linked to Lazarus, together represent roughly 95% of the month's losses and approximately 75% of everything stolen in crypto in 2026 so far.
The same state-sponsored hacking group behind both attacks. Different protocols. Different chains. Different vulnerability types. Same attacker.Beyond the dollar totals, the pace of attacks is accelerating in a way that concerns security researchers as much as the individual incident sizes. DeFi recorded 47 separate incidents in the first four and a half months of 2026, compared with 28 over the same period in 2025, a 68% year-over-year increase in attack frequency. The diversification of attack vectors means that technical audits and code reviews alone are no longer sufficient protection for protocols with significant TVL.
This is the part that most coverage misses. It's not just the dollar amounts. It's the shift in how protocols are being attacked. April's exploits cut across smart contract vulnerabilities, infrastructure attacks, and social engineering campaigns, including AI-driven attacks on wallets like Zerion. As crypto's cumulative hack losses have crossed $17 billion over the past decade, attackers are increasingly pivoting away from smart contract bugs toward private keys, signing infrastructure, and human-layer social engineering.
AI-driven social engineering attacks. That's new and it's serious. As protocols hardened their smart contract code through multiple audits, sophisticated attackers evolved to target the humans operating the infrastructure — developers with admin keys, bridge operators, multisig signers.Jefferies has warned the string of marquee hacks could temporarily slow Wall Street's appetite for DeFi tokenization projects. PowerDrillThis is where the institutional story intersects with the security story. BlackRock, Morgan Stanley, Stripe — they're all building infrastructure on or adjacent to DeFi rails. If $600M+ can be stolen in 18 days from protocols that were considered secure, institutional risk departments need new frameworks before they commit more capital."DeFi remains a niche market until risk can be properly priced," one analyst wrote.
That's the honest state of things. The technology is powerful. The security model isn't mature enough for the capital it's trying to hold. Both things are true simultaneously.
#CryptoHacks #DeFiSecurity #LazarusGroup #KelpDAO #CryptoSecurity

Hello, Binance Square folks!
April 2026 is recorded as one of the darkest months in the history of digital asset security. The latest data shows a concerning surge in exploits, serving as a strong warning to all of us that the crypto ecosystem remains a highly active cyber battlefield.
Scary Stats: 1,140% Surge
Last April logged a grim record with a total of 40 major exploits hitting various protocols. The total loss reached a jaw-dropping figure: US$646.89 million.

April 23, 2026
The numbers are in. They are catastrophic.
Crypto protocols have lost over $606 million to hacks and exploits in just the first 18 days of April 2026 making it the single worst month for theft in the industry since the $1.4 billion Bybit breach in February 2025.
Two attacks. Two names. Both point to the same culprit.

🔴 WHAT HAPPENED
The $285 million Drift Protocol attack on April 1st, and the $292 million KelpDAO breach on April 18th both later attributed to North Korea’s Lazarus Group together represent roughly 95% of April’s losses.
This wasn’t random. This was surgical.
Following the KelpDAO exploit alone, DeFi’s total value locked fell over 7% in 24 hours. Aave dropped from $26.4 billion to near $17.9 billion. Billions. Gone. Overnight.

🔥 WHY IT MATTERS
This isn’t just a bad month. The entire first quarter of 2026 saw just $165.5 million in losses. April’s total arrived in under three weeks making the month 3.7× larger than all of Q1 combined.
The pace is accelerating dangerously. DeFi recorded 47 separate incidents in the first 4.5 months of 2026, compared with 28 over the same period in 2025 a 68% year-over-year increase in attack frequency.

📉 MARKET REACTION
Panic. Institutional players are not waiting around. Institutional players responded with emergency rate limits and frozen bridge flows, while Jefferies warned the string of hacks could temporarily slow Wall Street’s appetite for DeFi tokenization projects.
$BTC is holding. Alts are bleeding. Risk-off mode is fully activated.

⚠️ MOST PEOPLE ARE MISSING THIS DETAIL…
Everyone is focused on the dollar amounts. But the real story is HOW they’re getting in.
April’s exploits cut across smart contract vulnerabilities, infrastructure attacks, AND social engineering campaigns including AI-driven attacks on wallets. The old playbook of “just get your code audited” is dead.
Lazarus Group is now deploying AI to target individuals. Your wallet. Your team. Your infra.
As one analyst put it bluntly: “DeFi remains a niche market until risk can be properly priced and right now, we’re far from it.”

🔮 WHAT HAPPENS NEXT
If even one more mid-size exploit hits before April 30th, the month’s total could approach $700 million.
The Clarity Act which could bring regulatory structure to protect DeFi looks like a lost cause for April, with a potential Senate committee hearing pushed into May at the earliest.
Meanwhile, the attackers are not slowing down.

The question isn’t whether your protocol will be targeted.
It’s whether you’ll still be solvent when it is. 🔒
#defi #KelpDAO #LazarusGroup #CryptoSecurity #BinanceSquare

has become a defining case study in systemic DeFi risk. Here is the expanded intelligence on the laundering operation, the Aave liquidity collapse, and the specific security failures involved.
1. The Laundering: A Masterclass in Cross-Chain Speed
The exploiter, linked to North Korea’s Lazarus Group, executed a highly efficient exit strategy after minting 116,500 rsETH (approx. $292M) out of thin air via a message-forgery attack.
• THORChain as a Black Box: Within 36 hours of the hack, the attackers routed nearly 75,700 ETH ($175M) through THORChain, swapping it directly into Native Bitcoin. By utilizing THORChain’s permissionless, non-custodial nodes, they successfully bypassed centralized exchange (CEX) freezes and mixed the funds before the Bitcoin rally to $78,400.
• The Arbitrum "Stumble": The only significant recovery occurred on April 21, when the Arbitrum Security Council used emergency intervention powers to freeze 30,766 ETH ($71M) held on the Arbitrum One network. This was a "jurisdictional" win: while the council could "steal back" the funds on their Layer 2, they had no power over the remaining $175M on Ethereum Mainnet.
• Privacy Layer: Small portions of the loot (approx. $78,000) were also detected moving through the Umbra privacy protocol to obscure the digital trail further.
2. Aave's $16B "Ghost" Crisis
Aave’s TVL didn't just drop; it underwent a structural liquidity collapse. Although Aave’s core smart contracts remained secure, the protocol’s risk management was weaponized by the hacker.
• Bad Debt Mechanics: The hacker deposited the unbacked rsETH into Aave V3 as collateral to borrow $190M in WETH and other assets. Because the rsETH had no real value, Aave was left with an estimated $196M to $230M in bad debt once the KelpDAO bridge was confirmed compromised.
• The 100% Utilization Trap: As whales and institutions (including Justin Sun) scrambled to withdraw, the WETH and USDT markets hit 100% utilization. This meant many regular depositors were effectively locked in, unable to withdraw their funds because the pools were completely drained by the panic.
• Flight to Quality: Over $1.3B of the withdrawn capital immediately rotated into SparkLend and other "hard" collateral protocols, signaling a massive loss of faith in Liquid Restaking Tokens (LRTs) as viable collateral.
3. Bridge Security: The "1-of-1" Single Point of Failure
The post-mortem from Chainalysis and LayerZero Labs revealed that this was not a code bug, but an infrastructure takeover.
• The RPC Compromise: Lazarus Group didn't hack the smart contracts. Instead, they compromised the internal RPC nodes used by the LayerZero Decentralized Verifier Network (DVN). They fed forged data to the verifier while simultaneously launching a DDoS attack on external nodes to prevent them from "correcting" the lie.
• The 1-of-1 Configuration: A major public feud erupted between KelpDAO and LayerZero. LayerZero revealed that KelpDAO had used a 1-of-1 DVN setup—meaning only one verifier needed to be fooled to release the bridge funds.
• Lazarus Sophistication: The malware used on the RPC nodes was engineered to self-destruct and wipe all logs/binaries once the $292M was released, leaving investigators with a "cold" digital crime scene.
The Bottom Line for 2026
This event confirms that while on-chain code is getting safer, off-chain infrastructure (RPCs/Oracles) and cross-chain verifier configurations are now the primary targets. The "Kelp Contagion" has forced a massive industry-wide shift toward Multi-Sig DVNs and lower LTVs for restaked assets. 🛡️🌉📉
#KelpDAO #Aave #LazarusGroup #DefiExploits #BridgeSecurity #Arbitrum #THORChain
Complete Laundering Operation
The KelpDAO exploiter swapped nearly all 75,700 stolen ETH (worth $175M) into Bitcoin through THORChain in just 36 hours, narrowing recovery to only Arbitrum's frozen portion.
DeFi Contagion Spreads
Aave TVL collapsed from $45.8B to $29.6B, losing $16.2B in deposits as the exploit created $230M bad debt and triggered panic withdrawals across protocols with no direct exposure.
Bridge Security Crisis
LayerZero attributed the attack to North Korea's Lazarus Group, highlighting cross-chain bridges remain the weakest link with 2026 exploit losses matching 2025 levels.$ETH

Two law enforcement actions dropped this week that, combined, reveal something important about where crypto sits in the global geopolitical order. This is no longer a story about financial fraud. This is state-level warfare being conducted through digital assets.The US seized nearly $500 million in Iranian crypto.The US says it seized nearly $500 million in Iranian crypto assets. This is part of the broader financial campaign against Iran running parallel to the Strait of Hormuz conflict. The IRGC and affiliated entities have been using crypto — Bitcoin, USDT, and Ethereum — to route payments outside the SWIFT system, pay for imports under sanctions, and compensate assets in ways that traditional financial monitoring can't easily track. CointelegraphThe seizure happened simultaneously with an FBI-led global operation that arrested 276 suspects in pig butchering schemes — an FBI-led global enforcement effort targeting crypto pig butchering schemes led to the arrest of 276 suspects. Pig butchering is the social engineering scam where targets are cultivated over weeks or months through fake romantic relationships before being manipulated into depositing crypto into fraudulent investment platforms. CointelegraphNorth Korea's Lazarus Group: 76% of all 2026 losses, $6B stolen since 2017.The security intelligence research firm said North Korean state-backed hackers account for 76% of all crypto scam and hack losses in 2026 and have stolen $6 billion since 2017.
New reporting this week on the Drift Protocol hack revealed the full scope of how Lazarus operates. The long con: North Korean spies spent months in-person to drain $285 million from Drift — the security intelligence research firm detailed how North Korean state-backed hackers infiltrated Drift through months of preparation, including suspected physical presence of operatives near the company's operations, before executing the exploit on April 1.
Months of in-person preparation. This isn't a lone hacker running code from a basement. This is a structured, state-funded operation with the same discipline as any military intelligence unit — because that's exactly what it is. North Korea funds a significant portion of its weapons programs through crypto theft. The $577 million stolen in 2026 is not a side project. It's a strategic revenue source. PowerDrillPowerDrillThe picture this paints of crypto's global status in 2026: Iran uses crypto to evade sanctions. The US uses blockchain forensics to trace and seize those assets. North Korea steals crypto at industrial scale to fund its military. South Korea's FISA is monitoring DeFi protocols for state-linked wallets.Bitcoin was designed to be censorship-resistant and permissionless. What nobody anticipated when Satoshi wrote the whitepaper was that "permissionless" would eventually mean "accessible to every actor on earth" — including the ones building nuclear weapons and circumventing global financial sanctions.This doesn't change the fundamental value of decentralized money. But it changes how we need to think about the security, regulation, and geopolitical context of the ecosystem we're all participating in.
#Bitcoin #LazarusGroup #CryptoSecurity #NorthKorea #IranSanctions