lazarusgroup

North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks
A state-sponsored hacking program, built inside a sanctioned government, executed 12 minutes of code and walked away with $577 million. This is not cybercrime. It is state-directed financial warfare — and the crypto industry is its primary battlefield.
📊 Q2 2026 — The Most Hacked Quarter in Crypto History
◆ Hackers carried out 83 incidents in Q2 2026 — the quarter with the most exploits ever recorded in the history of the crypto industry; total losses for the quarter reached $755.3 million (Crypto Economy)
◆ By the end of May 2026, total DeFi hack losses for the year exceeded $840 million across more than 50 incidents — a 70% year-over-year increase compared to the same window in 2025 (altFINS)
◆ April 2026 was identified as the single worst month in DeFi history — over 30 separate attacks tracked, netting attackers approximately $635 million in total; one of the highest monthly loss figures since early 2025 (Finextra)
◆ As recently as June 24, 2026, SecondFi on the Cardano ecosystem was exploited for an estimated $19.4–20 million, linked to a flaw in its proprietary wallet generation software — with SlowMist analysts estimating up to 129 million ADA compromised (Bitcoin Foundation)
🇰🇵 North Korea's Lazarus Group — The Verified Numbers
◆ North Korean hacking groups accounted for 76% of all crypto hack value in 2026 through April — not because they launched a wave of attacks, but because two attacks totaling $577 million dwarfed everything else; those two attacks represent just 3% of 2026's incident count (TRM)
◆ DPRK-linked actors stole $2.02 billion in 2025, a 51% year-on-year increase; North Korea's cumulative attributed crypto theft now exceeds $6.75 billion since 2017 (Sanctions.io)
◆ In the past two weeks of April alone, the group siphoned more than $500 million from two exploits; a senior blockchain security researcher at CertiK stated the crypto industry needs to start viewing Lazarus the same way banks view nation-state cyber actors — "as a constant and well-funded threat, not just another news headline" (CoinDesk)
◆ The UN Panel of Experts has estimated that crypto theft funds a material proportion of North Korea's ballistic missile and nuclear weapons development programs, documented in Security Council reports with specific transaction analysis linking attributed proceeds to weapons procurement networks (Sanctions.io)
🌉 Attack #1 — Drift Protocol: $285 Million, 12 Minutes, 6 Months of Planning
◆ The Drift Protocol breach on April 1, 2026 involved three weeks of pre-attack staging and months of social engineering to compromise protocol signers — the full drain of $285 million was then executed in approximately 12 minutes (TRM)
◆ The Drift attack was not a code exploit — it was a six-month social engineering operation targeting the people who controlled admin keys; private key compromises accounted for the majority of stolen funds, and smart contract audits provide no protection against a developer targeted by a state-backed team with months of patience (Phemex)
◆ The stolen tokens were converted to USDC via Jupiter, bridged to Ethereum, and swapped into ETH — distributed across fresh wallets before going dormant; the stolen ETH has not moved since the day of the theft, consistent with North Korea's documented strategy of holding proceeds for months or years before executing a structured cashout (TRM)
🌉 Attack #2 — KelpDAO: $292 Million Through a Single Bridge Flaw
◆ On April 18, 2026, KelpDAO was exploited for approximately $290 million after two blockchain servers hosted by LayerZero were compromised — a token linked to the Ethereum network was drained through a forged cross-chain message; LayerZero's statement said "preliminary indicators suggest attribution to a highly sophisticated state actor, likely DPRK's Lazarus Group" (UPI)
◆ The attacker exploited the protocol's bridge contract and created unbacked tokens, then used them to borrow real assets — Cyvers described this as "exactly how this kind of exploit blows up so fast" and confirmed it became a cross-protocol contagion event affecting at least 9 protocols simultaneously; Aave V3, SparkLend, Fluid, Compound, and Euler all moved to freeze exposure (CryptoPotato)
◆ After the Arbitrum Security Council froze approximately $75 million of the stolen funds, approximately $175 million in ETH was moved through THORChain and converted to Bitcoin — the same laundering route used in the 2025 Bybit theft; THORChain processed the vast majority of proceeds from both incidents, converting hundreds of millions in stolen ETH to Bitcoin with no operator intervention (TRM)
◆ More than $13 billion was wiped from total DeFi TVL in the two days following the KelpDAO breach alone (UPI)
🦠 The New Attack Vector Nobody Saw Coming — "Mach-O Man"
◆ Lazarus Group is now running a macOS-focused campaign dubbed "Mach-O Man" targeting executives at fintech and crypto firms through routine business communications — using a social engineering technique called ClickFix, where victims are lured into fake online meetings and instructed to paste a command into their Mac terminal, granting attackers access to corporate and financial systems (CoinDesk)
◆ Mach-O Man is a modular malware kit that often erases itself before victims realize they have been compromised — "Most victims of this hack will not realize their security has been breached until the damage has been done, at which time the malware will have already erased itself," according to CertiK's senior blockchain security researcher (CoinDesk)
◆ On March 12, 2026, OFAC designated new sanctions targets tied to North Korea's IT worker program, which has evolved from operatives applying for remote jobs at crypto firms to orchestrating fake hiring processes — posing as recruiters for prominent Web3 and AI companies to harvest credentials, source code, and VPN access (Sanctions.io)
⚠️ Why Cross-Chain Bridges Remain the Highest-Value Target
◆ Cross-chain bridge vulnerabilities accounted for $351 million — nearly half — of Q2 2026's total losses; the LayerZero bridge exploit alone facilitated the KelpDAO breach (Blockchain News)
◆ Bridges hold large pools of locked assets and rely on cross-chain messaging systems that are difficult to verify — when a bridge breaks, an attacker can drain the entire reserve backing wrapped tokens across multiple chains in a single transaction, making bridges the highest-value targets in DeFi; the problem is architectural, not just implementation-specific (1inch)
◆ Mitchell Amador, CEO of bug bounty platform Immunefi, warned that advances in artificial intelligence are exacerbating these trends — describing the rise of AI-enabled hacking as a "vulnerability apocalypse," with attackers leveraging machine learning to exploit weaknesses at unprecedented scale (Crypto Economy)
🔍 The Uncomfortable Reality
Compromised accounts now account for more than 50% of all DeFi attacks by incident count — overtaking traditional smart contract exploits as the primary source of losses for the first time; by dollar value, the skew is even more pronounced (altFINS)
The pattern is consistent across every major 2026 incident: the code is not the weakest link anymore. The humans who control the keys are. A six-month social engineering campaign targeting one developer is all it takes to drain a protocol holding hundreds of millions. No audit catches that. No smart contract upgrade prevents it. The industry's security model was built for the wrong threat.
With North Korea running what amounts to a state-funded cyber operation that stole $6.75 billion in crypto since 2017 to finance weapons programs — should global crypto platforms be legally required to implement government-grade cybersecurity standards, or does that fundamentally contradict what decentralized finance is supposed to be?
#CryptoSecurity #DeFiHacks #BlockchainSecurity #LazarusGroup #Web3

​Квітень 2026 року офіційно став «найкривавішим» місяцем для криптоіндустрії. Сукупні збитки з початку року вже перевищили $800 мільйонів, і майже весь цей об’єм припадає на останні 30 днів.
​Ми спостерігаємо не просто серію зломів, а системну кризу безпеки інфраструктури та комунікацій.
​📉 Хроніка квітня: Гіганти та їхні помилки
​Основний удар нанесли інциденти з величезним капіталом, де за атаками простежується почерк Lazarus Group:
​Kelp DAO ($292 млн): Критична вразливість «1-of-1 verifier» у мосту LayerZero.​Drift Protocol ($285 млн): Наслідки складної операції соціальної інженерії проти Solana-DEX.
​На цьому фоні менші проєкти стали наочними посібниками з помилок:
​Grinex ($13,74 млн): Біржа в ауті з середини місяця.​Volo Protocol ($3,5 млн): Експлуатація сховищ на Sui.​CoW Swap ($1,2 млн): Класичнa атака на інтерфейс.
​⚠️ Wasabi Protocol: Таємницю розкрито (UPD: $5 млн+)
​Після тривожного мовчання ситуація з Wasabi нарешті прояснилася. Станом на 30 квітня підтверджено збитки понад $5 млн на Ethereum та Arbitrum. Причина — баг у валідації підписів, що дозволив провести Replay Attack.
​🧠 Головний урок Wasabi: Коли «довіра» стає вразливістю
​Інцидент із Wasabi — це не просто черговий баг, а жорстке нагадування про три системні проблеми:
​Ілюзія безпечних підписів: Ми звикли вважати підпис транзакції захищеним, але якщо контракт не вміє відрізняти старий дозвіл від нового, ваші кошти стають власністю хакера.​Пастка Unlimited Approvals: Користувачі продовжують надавати протоколам необмежені права. Саме ці «сплячі» дозволи дозволили зловмиснику маніпулювати чужими активами.​Криза комунікації: Тривала пауза від команди без офіційного post-mortem — це неприпустимо у 2026 році. Інформаційний вакуум спалює довіру швидше, ніж хакер — ліквідність.
​🧩 Висновок: Ми знову не вчимося?
​Хакери змістили фокус із пошуку помилок у коді на інфраструктуру: DNS, RPC-вузли та адмін-ключі. Кожен звіт пише про одні й ті самі уроки, але наступна атака зазвичай стається за тією ж схемою ще до того, як індустрія впроваджує захист.
​#DeFi #WasabiProtocol #CryptoSecurity #BinanceSquare #Web3Safety #LazarusGroup #BlockchainSecurity

​Halo, Warga Binance Square!
​Melanjutkan laporan kita tentang lonjakan serangan siber sebesar 1.140% di bulan April 2026, muncul satu nama yang terus mendominasi berita utama: Lazarus Group.
​Namun, siapakah mereka sebenarnya? Mengapa mereka begitu terobsesi dengan DeFi? Dan untuk siapa mereka bekerja? Mari kita bedah tuntas profil kelompok peretas yang kini menyumbang 76% kerugian siber global tahun ini.
​1. Siapa Kelompok Lazarus?
​Lazarus Group (juga dikenal sebagai APT38) bukanlah sekelompok peretas amatir yang bekerja dari ruang bawah tanah. Mereka adalah unit elit siber yang sangat terorganisir dan memiliki pelatihan tingkat militer.
​Dunia pertama kali mengenal mereka secara luas melalui serangan terhadap Sony Pictures tahun 2014. Namun, sejak saat itu, mereka telah berevolusi menjadi mesin pencuri uang digital yang sangat canggih, menargetkan institusi keuangan dan protokol kripto dengan presisi yang mematikan.
​2. Apa Motif di Balik Serangan Mereka?
​Berbeda dengan kelompok peretas dari negara lain yang biasanya mencuri informasi untuk spionase politik, Lazarus memiliki satu motif utama: UANG.
Pendanaan Negara: Mereka bertindak sebagai instrumen pencari dana keras (hard currency) bagi negara yang sedang diisolasi secara ekonomi oleh sanksi internasional.Target Ekosistem Kripto: Lazarus memilih sektor kripto karena sifatnya yang tanpa batas dan relatif lebih mudah dikonversi dibandingkan sistem perbankan tradisional. Kasus eksploitasi Kelp DAO dan Drift Protocol baru-baru ini menjadi bukti bahwa mereka hanya mengincar "ikan besar" dengan hasil curian ratusan juta dolar.
​3. Untuk Siapa Mereka Bekerja?
​Analisis forensik digital dan laporan intelijen global (termasuk dari PBB dan FBI) telah mengonfirmasi bahwa Lazarus Group bekerja secara langsung untuk pemerintah Korea Utara.
​Mereka berada di bawah kendali Biro Umum Pengintaian (RGB), badan intelijen militer utama negara tersebut. Anggota kelompok ini adalah individu-individu terpilih yang dididik secara khusus dalam ilmu komputer sejak kecil. Operasi mereka sering kali dijalankan dari berbagai belahan dunia untuk menyamarkan jejak geografis dan menghindari pelacakan.
​Pelajaran bagi Investor Kripto
​Melihat fakta bahwa musuh yang kita hadapi di jaringan adalah organisasi tingkat negara, langkah keamanan tidak bisa lagi dilakukan dengan setengah hati.
​Kesabaran Predator: Lazarus dikenal sangat sabar. Mereka bisa mengintai sebuah protokol selama berbulan-bulan sebelum melakukan serangan.​Pesan Keamanan: Jika Anda adalah pemegang aset jangka panjang (target 2031), menyimpan aset di dompet panas (hot wallet) yang terhubung internet sangatlah berisiko. Gunakan Hardware Wallet dan pantau terus izin smart contract Anda.
​Kesimpulan:
Dunia kripto adalah kebebasan, namun kebebasan tanpa keamanan adalah kerentanan. Dengan mengenal siapa lawan kita, kita bisa membangun pertahanan yang lebih kuat.
​Bagaimana menurut kalian? Apakah regulasi keamanan siber saat ini sudah cukup untuk membendung serangan berskala negara seperti Lazarus? Mari berdiskusi!
​#CryptoSecurity #LazarusGroup #CyberInvestigation #BinanceSquareIndonesia #SafetyFirst2026
$BTC
$PEPE

While markets were watching $79,000 and the Iran ceasefire, something else happened in April that deserves serious attention.Crypto protocols lost over $606 million to hacks in just 18 days of April 2026, making it the worst month since February 2025's Bybit breach. The entire first quarter of 2026 saw $165.5 million in losses across a relatively quiet stretch. April's $606 million total arrived in under three weeks, making the month 3.7 times larger than Q1 combined and pushing 2026's year-to-date theft total to approximately $771.8 million across 47 separate incidents.
Two exploits account for nearly all of it. The $285 million Drift Protocol attack on April 1, later attributed to North Korea's Lazarus Group, and the $292 million KelpDAO breach on April 18, also linked to Lazarus, together represent roughly 95% of the month's losses and approximately 75% of everything stolen in crypto in 2026 so far.
The same state-sponsored hacking group behind both attacks. Different protocols. Different chains. Different vulnerability types. Same attacker.Beyond the dollar totals, the pace of attacks is accelerating in a way that concerns security researchers as much as the individual incident sizes. DeFi recorded 47 separate incidents in the first four and a half months of 2026, compared with 28 over the same period in 2025, a 68% year-over-year increase in attack frequency. The diversification of attack vectors means that technical audits and code reviews alone are no longer sufficient protection for protocols with significant TVL.
This is the part that most coverage misses. It's not just the dollar amounts. It's the shift in how protocols are being attacked. April's exploits cut across smart contract vulnerabilities, infrastructure attacks, and social engineering campaigns, including AI-driven attacks on wallets like Zerion. As crypto's cumulative hack losses have crossed $17 billion over the past decade, attackers are increasingly pivoting away from smart contract bugs toward private keys, signing infrastructure, and human-layer social engineering.
AI-driven social engineering attacks. That's new and it's serious. As protocols hardened their smart contract code through multiple audits, sophisticated attackers evolved to target the humans operating the infrastructure — developers with admin keys, bridge operators, multisig signers.Jefferies has warned the string of marquee hacks could temporarily slow Wall Street's appetite for DeFi tokenization projects. PowerDrillThis is where the institutional story intersects with the security story. BlackRock, Morgan Stanley, Stripe — they're all building infrastructure on or adjacent to DeFi rails. If $600M+ can be stolen in 18 days from protocols that were considered secure, institutional risk departments need new frameworks before they commit more capital."DeFi remains a niche market until risk can be properly priced," one analyst wrote.
That's the honest state of things. The technology is powerful. The security model isn't mature enough for the capital it's trying to hold. Both things are true simultaneously.
#CryptoHacks #DeFiSecurity #LazarusGroup #KelpDAO #CryptoSecurity

Halo, Warga Binance Square!
​April 2026 tercatat sebagai salah satu bulan paling kelam dalam sejarah keamanan aset digital. Data terbaru menunjukkan lonjakan eksploitasi yang sangat mengkhawatirkan, memberikan peringatan keras bagi kita semua bahwa ekosistem kripto masih menjadi medan pertempuran siber yang sangat aktif.
​Statistik Mengerikan: Lonjakan 1.140%
​Bulan April lalu mencatatkan rekor buruk dengan total 40 eksploitasi besar yang melanda berbagai protokol. Total kerugian mencapai angka fantastis: US$646,89 juta.
​Jika kita bandingkan dengan bulan sebelumnya, angka ini menunjukkan lonjakan kerugian sebesar 1.140%. Peningkatan drastis ini mengindikasikan bahwa para peretas kini menggunakan metode yang jauh lebih canggih dan agresif untuk menguras dana dari protokol-protokol besar.
​Dua korban terbesar dalam gelombang serangan ini adalah:
​Kelp DAO: Mengalami kerugian sebesar US$292 juta.​Drift Protocol: Kehilangan dana mencapai US$285 juta.
​Dominasi Lazarus Group: Kualitas di Atas Kuantitas
​Laporan keamanan siber 2026 menegaskan kembali dominasi kelompok peretas asal Korea Utara, khususnya Lazarus Group dan afiliasinya. Meskipun jumlah serangan yang mereka luncurkan tidak terlalu banyak secara frekuensi, dampak yang dihasilkan sangat menghancurkan.
​Kelompok ini bertanggung jawab atas 76% dari total kerugian siber di sektor kripto sepanjang tahun 2026. Target utama mereka tetap konsisten:
Protokol DeFi: Mencari celah pada logika smart contract.​Platform Lintas Rantai (Cross-chain Bridges): Mengeksploitasi kerentanan saat aset berpindah antar jaringan.
​Pelajaran Penting Bagi Investor
​Melihat fakta bahwa kelompok peretas profesional sekelas Lazarus kini mendominasi pasar, keamanan aset tidak bisa lagi dianggap remeh. Pertumbuhan portofolio kita tidak akan berarti apa-apa jika fondasi keamanannya rapuh.
​Sebagai langkah antisipasi, pastikan Anda:
Melakukan Audit Mandiri: Selalu cek hasil audit protokol DeFi sebelum melakukan staking atau penyediaan likuiditas dalam jumlah besar.​Gunakan Cold Storage: Untuk investasi jangka panjang (target 2031), pastikan aset Anda berada di hardware wallet yang terputus dari koneksi internet.​Batasi Izin Smart Contract: Secara rutin cabut izin (revoke) kontrak yang sudah tidak Anda gunakan lagi.
​Kesimpulan:
Keamanan adalah bagian integral dari investasi. Di tengah lonjakan serangan siber ini, jadilah investor yang tidak hanya pintar mencari cuan, tapi juga cerdik dalam menjaga aset.
​Bagaimana strategi keamanan Anda saat ini? Apakah Anda merasa protokol DeFi tempat Anda menyimpan aset sudah cukup aman? Mari berdiskusi di kolom komentar!
​#CryptoSecurity #LazarusGroup #Write2Earn #BinanceSquareIndonesia #CyberAttack2026
$PEPE
$BTTC

April 23, 2026
The numbers are in. They are catastrophic.
Crypto protocols have lost over $606 million to hacks and exploits in just the first 18 days of April 2026 making it the single worst month for theft in the industry since the $1.4 billion Bybit breach in February 2025.
Two attacks. Two names. Both point to the same culprit.

🔴 WHAT HAPPENED
The $285 million Drift Protocol attack on April 1st, and the $292 million KelpDAO breach on April 18th both later attributed to North Korea’s Lazarus Group together represent roughly 95% of April’s losses.
This wasn’t random. This was surgical.
Following the KelpDAO exploit alone, DeFi’s total value locked fell over 7% in 24 hours. Aave dropped from $26.4 billion to near $17.9 billion. Billions. Gone. Overnight.

🔥 WHY IT MATTERS
This isn’t just a bad month. The entire first quarter of 2026 saw just $165.5 million in losses. April’s total arrived in under three weeks making the month 3.7× larger than all of Q1 combined.
The pace is accelerating dangerously. DeFi recorded 47 separate incidents in the first 4.5 months of 2026, compared with 28 over the same period in 2025 a 68% year-over-year increase in attack frequency.

📉 MARKET REACTION
Panic. Institutional players are not waiting around. Institutional players responded with emergency rate limits and frozen bridge flows, while Jefferies warned the string of hacks could temporarily slow Wall Street’s appetite for DeFi tokenization projects.
$BTC is holding. Alts are bleeding. Risk-off mode is fully activated.

⚠️ MOST PEOPLE ARE MISSING THIS DETAIL…
Everyone is focused on the dollar amounts. But the real story is HOW they’re getting in.
April’s exploits cut across smart contract vulnerabilities, infrastructure attacks, AND social engineering campaigns including AI-driven attacks on wallets. The old playbook of “just get your code audited” is dead.
Lazarus Group is now deploying AI to target individuals. Your wallet. Your team. Your infra.
As one analyst put it bluntly: “DeFi remains a niche market until risk can be properly priced and right now, we’re far from it.”

🔮 WHAT HAPPENS NEXT
If even one more mid-size exploit hits before April 30th, the month’s total could approach $700 million.
The Clarity Act which could bring regulatory structure to protect DeFi looks like a lost cause for April, with a potential Senate committee hearing pushed into May at the earliest.
Meanwhile, the attackers are not slowing down.

The question isn’t whether your protocol will be targeted.
It’s whether you’ll still be solvent when it is. 🔒
#defi #KelpDAO #LazarusGroup #CryptoSecurity #BinanceSquare

Two law enforcement actions dropped this week that, combined, reveal something important about where crypto sits in the global geopolitical order. This is no longer a story about financial fraud. This is state-level warfare being conducted through digital assets.The US seized nearly $500 million in Iranian crypto.The US says it seized nearly $500 million in Iranian crypto assets. This is part of the broader financial campaign against Iran running parallel to the Strait of Hormuz conflict. The IRGC and affiliated entities have been using crypto — Bitcoin, USDT, and Ethereum — to route payments outside the SWIFT system, pay for imports under sanctions, and compensate assets in ways that traditional financial monitoring can't easily track. CointelegraphThe seizure happened simultaneously with an FBI-led global operation that arrested 276 suspects in pig butchering schemes — an FBI-led global enforcement effort targeting crypto pig butchering schemes led to the arrest of 276 suspects. Pig butchering is the social engineering scam where targets are cultivated over weeks or months through fake romantic relationships before being manipulated into depositing crypto into fraudulent investment platforms. CointelegraphNorth Korea's Lazarus Group: 76% of all 2026 losses, $6B stolen since 2017.The security intelligence research firm said North Korean state-backed hackers account for 76% of all crypto scam and hack losses in 2026 and have stolen $6 billion since 2017.
New reporting this week on the Drift Protocol hack revealed the full scope of how Lazarus operates. The long con: North Korean spies spent months in-person to drain $285 million from Drift — the security intelligence research firm detailed how North Korean state-backed hackers infiltrated Drift through months of preparation, including suspected physical presence of operatives near the company's operations, before executing the exploit on April 1.
Months of in-person preparation. This isn't a lone hacker running code from a basement. This is a structured, state-funded operation with the same discipline as any military intelligence unit — because that's exactly what it is. North Korea funds a significant portion of its weapons programs through crypto theft. The $577 million stolen in 2026 is not a side project. It's a strategic revenue source. PowerDrillPowerDrillThe picture this paints of crypto's global status in 2026: Iran uses crypto to evade sanctions. The US uses blockchain forensics to trace and seize those assets. North Korea steals crypto at industrial scale to fund its military. South Korea's FISA is monitoring DeFi protocols for state-linked wallets.Bitcoin was designed to be censorship-resistant and permissionless. What nobody anticipated when Satoshi wrote the whitepaper was that "permissionless" would eventually mean "accessible to every actor on earth" — including the ones building nuclear weapons and circumventing global financial sanctions.This doesn't change the fundamental value of decentralized money. But it changes how we need to think about the security, regulation, and geopolitical context of the ecosystem we're all participating in.
#Bitcoin #LazarusGroup #CryptoSecurity #NorthKorea #IranSanctions