lazarus

In March 2022, the decentralized finance (DeFi) space was rocked by an unprecedented disaster. Ronin Network, an Ethereum-linked sidechain built specifically for the blockchain gaming phenomenon Axie Infinity (owned by Sky Mavis), suffered a devastating breach.
A total of 173,600 Ethereum (ETH) and 25.5 million USDC were systematically drained. The total damage? A staggering $620 million, securing its place as one of the largest cryptocurrency heists in history.
However, the real shockwave wasn't just the astronomical number; it was the chilling psychological warfare and "Social Engineering" tactics used by the North Korean state-backed Lazarus Group to breach the network.
The Bait: Hunting a Senior Developer on LinkedIn 🧳
The heist did not begin with complex zero-day exploits or breaking cryptographic codes. Instead, it started with a simple interaction on the professional networking platform LinkedIn.
Lazarus Group operatives crafted highly sophisticated, premium fake profiles posing as recruiters from prestigious global tech firms and venture capital funds. They meticulously scanned the employees of Sky Mavis and locked onto their target: a Senior Software Engineer with extensive access privileges within the network.
The fake recruiters approached the developer with a "dream job opportunity," boasting a massive salary package and benefits too good to turn down. To sell the illusion, they put the developer through multiple rounds of rigorous technical interviews over several weeks. The engineer had absolutely no reason to suspect that the professional on the other side of the screen was an elite state-sponsored cyber operative.
The Payload: The Malicious "Offer Letter"
After clearing the final round of interviews, the developer was told they had officially secured the role. The "recruiters" sent over the official job offer package wrapped inside a standard PDF document.
But it was a Trojan horse. The document contained highly advanced, tailored spyware. The moment the developer downloaded and opened the file on their official company laptop, the malware infected the machine and quietly bypassed traditional endpoint security, giving the hackers deep access to the inner architecture of Sky Mavis.
Exposing the Critical Vulnerability: Subverting the Nodes
To secure transactions and asset bridges, the Ronin Network utilized a Proof of Authority (PoA) consensus mechanism relying on 9 Validator Nodes. For any withdrawal to be authorized, it required cryptographic signatures from at least 5 out of the 9 nodes (a 5/9 majority).
Once inside the developer's laptop, the Lazarus hackers successfully extracted the private keys of four validator nodes managed directly by Sky Mavis.
However, they still needed a fifth signature to authorize the multi-million dollar theft. To get it, they exploited a lingering oversight in the infrastructure. Months prior, Sky Mavis had granted an unrevoked permission to a community group called the Axie DAO to sign off on transactions to mitigate heavy network traffic. The hackers used their access to exploit this loophole, pulling the fifth signature from the Axie DAO bridge.
With a 5/9 majority secured, the hackers forged withdrawal orders and drained $620 million into their own wallets within minutes.
The Twist: A 6-Day Delayed Realization
What makes this historical heist incredibly bizarre is that the funds were drained on March 23, 2022, but Sky Mavis did not realize they had been hacked until March 29-six full days later! The breach was only discovered when a legitimate user tried to withdraw 5,000 ETH, and the transaction failed because the liquidity pools had already been completely emptied.
The Aftermath and Recovery
The FBI and the U.S. Treasury Department quickly took over the investigation, officially tying the hacker addresses directly to the Lazarus Group. The stolen funds were funneled through the popular privacy mixer Tornado Cash, which ultimately led to heavy sanctions against the protocol by the U.S. government.
Despite the devastating loss, Sky Mavis successfully raised $150 million in a funding round led by Binance and other prominent investors to fully reimburse the affected users. They completely overhauled their security protocol, expanding their validator node count to over 20 to ensure such a bottleneck could never happen again.
The Golden Takeaway: You can spend millions of dollars building un-hackable cryptographic code, but the human element remains the ultimate security threshold. A single click on a malicious file can bring down an entire financial fortress.
#RoninNetwork #Lazarus
#OnChain #DeFi #ETH

Hackers didn't just break into crypto this quarter — they engineered the most sophisticated assault in blockchain history.
◆ Record-Breaking Quarter: Q2 2026 has become the most-hacked quarter on record by incident count, with 83 exploits targeting cryptocurrency protocols — resulting in $755.3 million in total losses, according to DefiLlama data. (Cointelegraph)
◆ Two Attacks, Half a Billion Gone: KelpDAO's $293 million hack and Drift Protocol's $280 million exploit were the two largest incidents of the quarter — together accounting for over 73% of all Q2 losses. (Cointelegraph)
◆ Bridges Are the Weakest Link: Cross-chain bridge exploits emerged as the biggest attack vector, with $351 million stolen from bridges alone — representing nearly half of all Q2 losses. The LayerZero OFT bridge exploit, which triggered the KelpDAO hack, accounted for more than 38% of the quarter's total stolen value. (Cointelegraph)
◆ North Korea Is the Biggest Threat: North Korean state-linked hackers connected to the Lazarus Group are believed to have accounted for approximately 76% of crypto-related hack losses globally in 2026 — including the Drift and KelpDAO heists. The group had previously been linked to the $1.4 billion Bybit hack in February 2025. (Finextra)
◆ Social Engineering Now Beats Code Attacks: The Drift Protocol breach was not a code exploit — it was a six-month social engineering operation targeting the people who controlled admin keys. Smart contract audits protect against code bugs, but they do not protect against a developer getting phished by a state-backed team with months of patience. (Phemex)
◆ Latest Victim — June 24: SecondFi, a project in the Cardano ecosystem, was hit by a major exploit linked to a flaw in its proprietary wallet generation software. SlowMist analysts estimate losses at over $20 million, involving more than 129 million ADA and additional tokens. (Bitcoin Foundation)
◆ AI Is Now a Hacker's Tool: Immunefi CEO Mitchell Amador warned that advances in artificial intelligence could be exacerbating these trends, describing the rise of AI-enabled hacking as a "vulnerability apocalypse" — with attackers leveraging machine learning to exploit weaknesses at unprecedented scale. (Blockchain News)
◆ DeFi TVL Shrinking Under Attack Pressure: Total value locked in DeFi has fallen from $164 billion before the October 10 liquidation event to approximately $73 billion — a collapse that reflects both market conditions and eroding confidence in protocol security. (Cointelegraph)
◆ All-Time Damage Crosses $16.5 Billion: Since DeFi entered the crypto space, cumulative exploit-related losses have surpassed $16.5 billion all-time, with bridge exploits alone accounting for $2.9 billion of that total. (Finextra)
The message from 2026's security data is clear: the code is getting harder to crack, so attackers have moved to the human layer — employees, developers, and infrastructure operators. No audit can fix a six-month social engineering campaign funded by a nation state.
If the biggest threat to crypto is now human error and nation-state hackers — not flawed code — what should protocols prioritize first: better audits, better employee security training, or decentralized key management?
#CryptoSecurity #DeFiHacks #BlockchainSecurity #CryptoNews #Lazarus

Recently, Arbitrum's operation to 'freeze hacker ETH' has indeed caused a stir in the crypto world. As players focused on Layer 2 and on-chain governance, we need to discuss this thoroughly.
The main character in this incident is 30,766 ETH (approximately 70 million to 100 million dollars at current market price), which originally belonged to KelpDAO that was hacked a few days ago. Just today (April 21, 2026), the Arbitrum Security Council exercised its 'emergency powers' and directly transferred this amount to a frozen wallet.
1. The ins and outs of the matter
A brief recap: On April 18, KelpDAO's cross-chain bridge was hacked, losing nearly 300 million dollars. The hacker (reportedly the Lazarus group again) initially wanted to launder the money, but the Arbitrum Security Council reacted extremely quickly this time. Out of 12 members, 9 voted in favor, using emergency multi-signature authority to intercept the funds precisely before the hacker could transfer the money to the mainnet or mix it.

The infamous North Korean hacking group "Lazarus Group" has launched a new and innovative cyber attack campaign directly targeting executives in the crypto and FinTech sectors.
Cybersecurity researchers at "CertiK" revealed this complex operation on Wednesday, dubbing it "Mach-O Man."