Over the weekend, hackers stole more than $290 million worth of cryptocurrency from Kelp DAO, a protocol that enables users to earn yield on idle crypto assets.
By Monday, LayerZero—one of the projects impacted by the incident—publicly accused North Korea-linked actors of orchestrating the attack. The breach is now being described as the largest cryptocurrency theft of the year so far, surpassing an earlier April hack on the Drift crypto exchange that resulted in losses of around $285 million.
In a post shared on X, LayerZero said the attackers exploited Kelp DAO through its LayerZero bridge infrastructure, which enables communication between different blockchains. According to the company, the attackers exploited security configurations in Kelp’s system that did not require multiple verification steps before approving transactions. This allowed fraudulent transfers to bypass safeguards and drain funds.
LayerZero said “preliminary indicators” suggest the involvement of North Korea-linked hacking groups, specifically referencing TraderTraitor, a cybercrime unit known for targeting cryptocurrency platforms.
Kelp DAO pushed back against the accusation, instead suggesting that LayerZero bears responsibility for the vulnerability that led to the exploit.
North Korean state-linked hacking groups, operating under the direction of Kim Jong Un’s regime, have become increasingly active in crypto theft operations in recent years. These groups have reportedly stolen billions of dollars in digital assets, using sophisticated techniques to target exchanges, bridges, and decentralised finance protocols.
In 2025 alone, North Korea-linked hackers are estimated to have stolen more than $2 billion in cryptocurrency. Since 2017, the total value of crypto assets attributed to North Korean cyber operations is estimated at approximately $6 billion.
