Drift

2026

DeFi

LayerZero

Ronin

<p><strong>North Korea has been allegedly linked to $577 million in cryptocurrency stolen across two separate attacks targeting Drift Protocol and KelpDAO, according to multiple security researchers and blockchain analytics firms. The combined losses represent one of the largest alleged state-sponsored crypto theft campaigns reported in 2026.</strong></p>
<h2 id="what-the-allegation-says-about-the-577-million-theft">What the allegation says about the $577 million theft</h2>
<p>The reported figure combines approximately $280 million lost in the Drift Protocol exploit and roughly $290 million drained from KelpDAO. Both incidents have been tied to North Korea's Lazarus Group by independent blockchain forensics teams.</p>
<p>TRM Labs reported that North Korea was responsible for <a href="https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks" rel="noopener noreferrer nofollow">76% of all crypto hack value in 2026</a> through just two attacks. The attribution remains alleged rather than confirmed by any government authority, and readers should treat the North Korea connection with appropriate caution.</p>
<p>Elliptic described the Drift Protocol incident as a <a href="https://www.elliptic.co/blog/drift-protocol-exploited-for-286-million-in-suspected-dprk-linked-attack" rel="noopener noreferrer nofollow">suspected DPRK-linked attack</a> involving approximately $286 million. The language from multiple analytics firms consistently uses terms like "suspected" and "tied to" rather than definitive attribution.</p>
<h2 id="how-the-two-protocols-were-targeted">How the two protocols were targeted</h2>
<p>Drift Protocol, a decentralized perpetual futures exchange on Solana, reportedly lost funds after attackers <a href="https://www.bleepingcomputer.com/news/security/drift-loses-280-million-as-hackers-seize-security-council-powers/amp/" rel="noopener noreferrer nofollow">seized security council powers</a> within the protocol's governance structure. The exploit highlights a growing concern around governance-layer vulnerabilities in DeFi, a risk category that has also drawn attention in cases involving <a rel="noopener noreferrer nofollow">exchange-level security failures and frozen user assets</a>.</p>
<p>KelpDAO, a liquid restaking protocol, suffered a separate $290 million exploit. LayerZero attributed that attack to the Lazarus Group, according to <a href="https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/" rel="noopener noreferrer nofollow">reporting from BleepingComputer</a>. The incident was independently corroborated by <a href="https://castlecrypto.gg/news/kelpdao-suffers-290m-exploit-as-layerzero-attributes-attack-to-lazarus-group/" rel="noopener noreferrer nofollow">CastleCrypto</a>.</p>
<p>Both protocols operate in high-value DeFi sectors, with Drift handling leveraged trading volume and KelpDAO managing restaked assets. The scale of losses in both cases underscores the risk concentration in protocols that custody or control large pools of user capital.</p>
<h2 id="why-alleged-state-linked-attribution-raises-the-stakes">Why alleged state-linked attribution raises the stakes</h2>
<p>If the North Korea connection is accurate, the stolen funds would likely fall under existing sanctions regimes. Exchanges and DeFi front-ends that process tokens traceable to these exploits could face compliance exposure, particularly under U.S. Treasury OFAC guidelines.</p>
<p>The Lazarus Group has been linked to multiple prior crypto thefts, including the 2022 Ronin Bridge exploit. A pattern of alleged state-sponsored attacks at nine-figure scale creates pressure on protocols to adopt more rigorous access controls and multisig governance standards. Incidents like these also raise questions about how platforms handle post-exploit asset recovery, similar to the challenges seen when <a rel="noopener noreferrer nofollow">exchanges adjust their listed assets</a> in response to security concerns.</p>
<p>For users of both Drift Protocol and KelpDAO, the immediate concern is whether deposited funds are recoverable. Neither protocol has publicly confirmed full remediation details as of this writing.</p>
<h2 id="what-remains-unconfirmed">What remains unconfirmed</h2>
<p>Several critical details have not been independently confirmed. The exact attack vectors used in both exploits have not been fully disclosed by either protocol team.</p>
<p>No government agency has formally attributed either attack to North Korea or the Lazarus Group. The attribution currently rests on analysis from private blockchain forensics firms.</p>
<p>The status of any fund recovery efforts, user compensation plans, or law enforcement investigations has not been publicly disclosed. Whether any portion of the stolen assets has been frozen on centralized exchanges is also not yet known, a factor that could prove critical as <a rel="noopener noreferrer nofollow">major exchanges expand their product offerings</a> and compliance infrastructure simultaneously.</p>
<h2 id="faq-drift-protocol-kelpdao-and-the-577-million-claim">FAQ: Drift Protocol, KelpDAO, and the $577 million claim</h2>
<p><strong>What does the $577 million figure refer to?</strong></p>
<p>It represents the combined reported losses from two separate DeFi exploits: approximately $280-286 million from Drift Protocol and approximately $290 million from KelpDAO.</p>
<p><strong>Why are Drift Protocol and KelpDAO mentioned together?</strong></p>
<p>Both attacks have been linked by blockchain analytics firms to the same alleged perpetrator, North Korea's Lazarus Group. TRM Labs grouped them as accounting for the majority of crypto hack losses in 2026.</p>
<p><strong>Has the North Korea link been confirmed?</strong></p>
<p>No. The connection is based on analysis from private firms including TRM Labs, Elliptic, and LayerZero. No government entity has issued formal attribution as of this report.</p>
<p>Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making any investment decisions.</p><a href="https://trustscrypto.com/?p=5218" rel="noopener noreferrer nofollow">Read original article on trustscrypto.com</a>

North Korea Allegedly Linked to $577M in Drift, KelpDAO Attacks

Table of Contents

TrustsCrypto

Other articles published on May 9, 2026

Join our free newsletter for daily crypto updates!