lazarusgroup

Two law enforcement actions dropped this week that, combined, reveal something important about where crypto sits in the global geopolitical order. This is no longer a story about financial fraud. This is state-level warfare being conducted through digital assets.The US seized nearly $500 million in Iranian crypto.The US says it seized nearly $500 million in Iranian crypto assets. This is part of the broader financial campaign against Iran running parallel to the Strait of Hormuz conflict. The IRGC and affiliated entities have been using crypto — Bitcoin, USDT, and Ethereum — to route payments outside the SWIFT system, pay for imports under sanctions, and compensate assets in ways that traditional financial monitoring can't easily track. CointelegraphThe seizure happened simultaneously with an FBI-led global operation that arrested 276 suspects in pig butchering schemes — an FBI-led global enforcement effort targeting crypto pig butchering schemes led to the arrest of 276 suspects. Pig butchering is the social engineering scam where targets are cultivated over weeks or months through fake romantic relationships before being manipulated into depositing crypto into fraudulent investment platforms. CointelegraphNorth Korea's Lazarus Group: 76% of all 2026 losses, $6B stolen since 2017.The security intelligence research firm said North Korean state-backed hackers account for 76% of all crypto scam and hack losses in 2026 and have stolen $6 billion since 2017.

New reporting this week on the Drift Protocol hack revealed the full scope of how Lazarus operates. The long con: North Korean spies spent months in-person to drain $285 million from Drift — the security intelligence research firm detailed how North Korean state-backed hackers infiltrated Drift through months of preparation, including suspected physical presence of operatives near the company's operations, before executing the exploit on April 1.

Months of in-person preparation. This isn't a lone hacker running code from a basement. This is a structured, state-funded operation with the same discipline as any military intelligence unit — because that's exactly what it is. North Korea funds a significant portion of its weapons programs through crypto theft. The $577 million stolen in 2026 is not a side project. It's a strategic revenue source. PowerDrillPowerDrillThe picture this paints of crypto's global status in 2026: Iran uses crypto to evade sanctions. The US uses blockchain forensics to trace and seize those assets. North Korea steals crypto at industrial scale to fund its military. South Korea's FISA is monitoring DeFi protocols for state-linked wallets.Bitcoin was designed to be censorship-resistant and permissionless. What nobody anticipated when Satoshi wrote the whitepaper was that "permissionless" would eventually mean "accessible to every actor on earth" — including the ones building nuclear weapons and circumventing global financial sanctions.This doesn't change the fundamental value of decentralized money. But it changes how we need to think about the security, regulation, and geopolitical context of the ecosystem we're all participating in.

#Bitcoin #LazarusGroup #CryptoSecurity #NorthKorea #IranSanctions

​Квітень 2026 року офіційно став «найкривавішим» місяцем для криптоіндустрії. Сукупні збитки з початку року вже перевищили $800 мільйонів, і майже весь цей об’єм припадає на останні 30 днів.
​Ми спостерігаємо не просто серію зломів, а системну кризу безпеки інфраструктури та комунікацій.
​📉 Хроніка квітня: Гіганти та їхні помилки
​Основний удар нанесли інциденти з величезним капіталом, де за атаками простежується почерк Lazarus Group:
​Kelp DAO ($292 млн): Критична вразливість «1-of-1 verifier» у мосту LayerZero.​Drift Protocol ($285 млн): Наслідки складної операції соціальної інженерії проти Solana-DEX.
​На цьому фоні менші проєкти стали наочними посібниками з помилок:
​Grinex ($13,74 млн): Біржа в ауті з середини місяця.​Volo Protocol ($3,5 млн): Експлуатація сховищ на Sui.​CoW Swap ($1,2 млн): Класичнa атака на інтерфейс.
​⚠️ Wasabi Protocol: Таємницю розкрито (UPD: $5 млн+)
​Після тривожного мовчання ситуація з Wasabi нарешті прояснилася. Станом на 30 квітня підтверджено збитки понад $5 млн на Ethereum та Arbitrum. Причина — баг у валідації підписів, що дозволив провести Replay Attack.
​🧠 Головний урок Wasabi: Коли «довіра» стає вразливістю
​Інцидент із Wasabi — це не просто черговий баг, а жорстке нагадування про три системні проблеми:
​Ілюзія безпечних підписів: Ми звикли вважати підпис транзакції захищеним, але якщо контракт не вміє відрізняти старий дозвіл від нового, ваші кошти стають власністю хакера.​Пастка Unlimited Approvals: Користувачі продовжують надавати протоколам необмежені права. Саме ці «сплячі» дозволи дозволили зловмиснику маніпулювати чужими активами.​Криза комунікації: Тривала пауза від команди без офіційного post-mortem — це неприпустимо у 2026 році. Інформаційний вакуум спалює довіру швидше, ніж хакер — ліквідність.
​🧩 Висновок: Ми знову не вчимося?
​Хакери змістили фокус із пошуку помилок у коді на інфраструктуру: DNS, RPC-вузли та адмін-ключі. Кожен звіт пише про одні й ті самі уроки, але наступна атака зазвичай стається за тією ж схемою ще до того, як індустрія впроваджує захист.

​#DeFi #WasabiProtocol #CryptoSecurity #BinanceSquare #Web3Safety #LazarusGroup #BlockchainSecurity

While markets were watching $79,000 and the Iran ceasefire, something else happened in April that deserves serious attention.Crypto protocols lost over $606 million to hacks in just 18 days of April 2026, making it the worst month since February 2025's Bybit breach. The entire first quarter of 2026 saw $165.5 million in losses across a relatively quiet stretch. April's $606 million total arrived in under three weeks, making the month 3.7 times larger than Q1 combined and pushing 2026's year-to-date theft total to approximately $771.8 million across 47 separate incidents.
Two exploits account for nearly all of it. The $285 million Drift Protocol attack on April 1, later attributed to North Korea's Lazarus Group, and the $292 million KelpDAO breach on April 18, also linked to Lazarus, together represent roughly 95% of the month's losses and approximately 75% of everything stolen in crypto in 2026 so far.
The same state-sponsored hacking group behind both attacks. Different protocols. Different chains. Different vulnerability types. Same attacker.Beyond the dollar totals, the pace of attacks is accelerating in a way that concerns security researchers as much as the individual incident sizes. DeFi recorded 47 separate incidents in the first four and a half months of 2026, compared with 28 over the same period in 2025, a 68% year-over-year increase in attack frequency. The diversification of attack vectors means that technical audits and code reviews alone are no longer sufficient protection for protocols with significant TVL.
This is the part that most coverage misses. It's not just the dollar amounts. It's the shift in how protocols are being attacked. April's exploits cut across smart contract vulnerabilities, infrastructure attacks, and social engineering campaigns, including AI-driven attacks on wallets like Zerion. As crypto's cumulative hack losses have crossed $17 billion over the past decade, attackers are increasingly pivoting away from smart contract bugs toward private keys, signing infrastructure, and human-layer social engineering.
AI-driven social engineering attacks. That's new and it's serious. As protocols hardened their smart contract code through multiple audits, sophisticated attackers evolved to target the humans operating the infrastructure — developers with admin keys, bridge operators, multisig signers.Jefferies has warned the string of marquee hacks could temporarily slow Wall Street's appetite for DeFi tokenization projects. PowerDrillThis is where the institutional story intersects with the security story. BlackRock, Morgan Stanley, Stripe — they're all building infrastructure on or adjacent to DeFi rails. If $600M+ can be stolen in 18 days from protocols that were considered secure, institutional risk departments need new frameworks before they commit more capital."DeFi remains a niche market until risk can be properly priced," one analyst wrote.
That's the honest state of things. The technology is powerful. The security model isn't mature enough for the capital it's trying to hold. Both things are true simultaneously.
#CryptoHacks #DeFiSecurity #LazarusGroup #KelpDAO #CryptoSecurity

April 23, 2026
The numbers are in. They are catastrophic.
Crypto protocols have lost over $606 million to hacks and exploits in just the first 18 days of April 2026 making it the single worst month for theft in the industry since the $1.4 billion Bybit breach in February 2025.
Two attacks. Two names. Both point to the same culprit.

🔴 WHAT HAPPENED
The $285 million Drift Protocol attack on April 1st, and the $292 million KelpDAO breach on April 18th both later attributed to North Korea’s Lazarus Group together represent roughly 95% of April’s losses.
This wasn’t random. This was surgical.
Following the KelpDAO exploit alone, DeFi’s total value locked fell over 7% in 24 hours. Aave dropped from $26.4 billion to near $17.9 billion. Billions. Gone. Overnight.

🔥 WHY IT MATTERS
This isn’t just a bad month. The entire first quarter of 2026 saw just $165.5 million in losses. April’s total arrived in under three weeks making the month 3.7× larger than all of Q1 combined.
The pace is accelerating dangerously. DeFi recorded 47 separate incidents in the first 4.5 months of 2026, compared with 28 over the same period in 2025 a 68% year-over-year increase in attack frequency.

📉 MARKET REACTION
Panic. Institutional players are not waiting around. Institutional players responded with emergency rate limits and frozen bridge flows, while Jefferies warned the string of hacks could temporarily slow Wall Street’s appetite for DeFi tokenization projects.
$BTC is holding. Alts are bleeding. Risk-off mode is fully activated.

⚠️ MOST PEOPLE ARE MISSING THIS DETAIL…
Everyone is focused on the dollar amounts. But the real story is HOW they’re getting in.
April’s exploits cut across smart contract vulnerabilities, infrastructure attacks, AND social engineering campaigns including AI-driven attacks on wallets. The old playbook of “just get your code audited” is dead.
Lazarus Group is now deploying AI to target individuals. Your wallet. Your team. Your infra.
As one analyst put it bluntly: “DeFi remains a niche market until risk can be properly priced and right now, we’re far from it.”

🔮 WHAT HAPPENS NEXT
If even one more mid-size exploit hits before April 30th, the month’s total could approach $700 million.
The Clarity Act which could bring regulatory structure to protect DeFi looks like a lost cause for April, with a potential Senate committee hearing pushed into May at the earliest.
Meanwhile, the attackers are not slowing down.

The question isn’t whether your protocol will be targeted.
It’s whether you’ll still be solvent when it is. 🔒

#defi #KelpDAO #LazarusGroup #CryptoSecurity #BinanceSquare

За даними Arkham Intelligence, організатор зламу Bybit на суму 1,5 мільярда доларів був ідентифікований, і винуватцем є не хто інший, як Lazarus Group, сумнозвісний північнокорейський синдикат кіберзлочинців.

🔎 Що ми знаємо на даний момент:
🔹 Lazarus Group має історію великих криптовалютних крадіжок, відмиваючи мільярди через складні блокчейн-транзакції.
🔹 Викрадені кошти переміщуються через кілька гаманців, що ускладнює повернення.
🔹 Влада та аналітики блокчейну зараз відстежують активи, щоб запобігти ліквідації.

⚠️ Що далі?
Ця атака посилює потребу в більш сильних заходах криптобезпеки та глобальній співпраці для боротьби з кіберзлочинністю. Чи Bybit поверне втрачені кошти, чи це ще одна загадка на мільярд доларів?

💬 Що ви думаєте про останнє пограбування криптовалюти? Залиште свої думки нижче! 👇

👉 Слідкуйте за новинами про криптовалюту в реальному часі! – Мухаммад Еджаз
#BybitHack #CryptoSecurity #LazarusGroup #CyberCrimeFighter #BlockchainForensics 🚨