Connect with us
DAPA Banner

Crypto World

KelpDAO $290M Hack Wipes $13B From DeFi

Published

on

Ethereum Foundation-funded project exposes 100 DPRK developers operating in crypto

A $290 million exploit on KelpDAO’s cross-chain bridge on April 18, attributed by LayerZero to North Korea’s Lazarus Group, sent shockwaves through DeFi and erased more than $13 billion in total value locked across protocols within 48 hours.

Summary

  • Attackers drained 116,500 rsETH worth approximately $290 million from KelpDAO’s LayerZero-powered bridge on April 18 in 2026’s largest DeFi exploit to date.
  • LayerZero has attributed the attack with preliminary confidence to North Korea’s Lazarus Group, specifically its TraderTraitor subunit.
  • The fallout triggered over $13 billion in outflows from DeFi platforms including Aave, which froze rsETH markets on both its V3 and V4 deployments.

Attackers drained 116,500 rsETH, worth approximately $290 million, from KelpDAO’s LayerZero-powered cross-chain bridge on April 18, in what CoinDesk has called 2026’s largest DeFi exploit to date. LayerZero, whose infrastructure underpinned the bridge, said in a statement Monday that “preliminary indicators suggest attribution to a highly sophisticated state actor, likely DPRK’s Lazarus Group.”

KelpDAO Hack Triggers $13 Billion DeFi Meltdown

The attack worked by compromising two remote procedure call nodes that LayerZero’s verifier relied on to confirm cross-chain transactions, then flooding backup nodes with junk traffic to force failover to the poisoned endpoints. Once the verifier signed off on a fabricated transaction, the bridge released $290 million in rsETH to an attacker-controlled address. The malware then self-destructed, wiping binaries and logs to frustrate forensic investigation. As crypto.news reported, the exploit triggered over $10 billion in outflows from Aave alone, with the lending protocol’s total value locked dropping from $45.8 billion to $35.7 billion as users scrambled to exit. UPI reported that more than $13 billion was wiped from total value locked across DeFi platforms in the two days following the breach.

Advertisement

LayerZero and KelpDAO Trade Blame Over Security Configuration

A dispute has erupted over who bears responsibility for the vulnerability that made the attack possible. LayerZero said KelpDAO had chosen to operate a 1-of-1 decentralized verifier network configuration, a single point of failure it had repeatedly warned against, and announced it would no longer sign messages for any application using that setup. KelpDAO pushed back, telling CoinDesk its configuration followed LayerZero’s own documented defaults and that the compromised validator was part of LayerZero’s own infrastructure. As crypto.news documented, independent security researchers including a Yearn Finance developer found that LayerZero’s public deployment code ships with single-source verification defaults across every major chain, undercutting the firm’s claim that KelpDAO had deviated from guidance.

What the Hack Means for DeFi Security and Institutional Confidence

The KelpDAO exploit is the second major DeFi breach linked to Lazarus in April alone, following the $285 million Drift Protocol attack on April 1, bringing the group’s total DeFi haul for the month to over $575 million. The attacker has since begun laundering the stolen funds, routing assets through Arbitrum and into Tron-based stablecoins, as crypto.news has tracked. Jefferies has warned that marquee hacks of this scale could temporarily slow Wall Street’s appetite for tokenization projects, as institutions reassess the security risks embedded in DeFi bridge infrastructure. LayerZero said it has confirmed zero contagion to other applications running multi-verifier configurations, but has forced a protocol-wide migration away from single-validator setups.

LayerZero said it is working with KelpDAO, the Security Alliance, and law enforcement agencies to trace the stolen funds, though the attacker’s use of privacy tools has significantly complicated recovery efforts.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Iran Seizes Ships in Strait of Hormuz

Published

on

Iran strikes Gulf energy network as oil surges past $110

Iran’s Revolutionary Guard seized two container ships in the Strait of Hormuz on April 22, hours after President Trump extended the ceasefire with Tehran indefinitely, while confirming the US naval blockade of Iranian ports would remain in place.

Summary

  • Iran’s Revolutionary Guard seized two ships in the Strait of Hormuz and fired on a third, citing maritime violations.
  • Trump extended the ceasefire with Iran to allow for further peace talks but kept the US naval blockade active.
  • Brent crude surged past $100 per barrel following the incidents, adding pressure to global energy markets and crypto assets.

Iran’s Islamic Revolutionary Guard Corps Navy announced on April 22 that it had seized two container ships transiting the Strait of Hormuz, citing what it described as maritime violations, according to NBC News and CNBC. The seizures came hours after President Trump announced an indefinite extension of the ceasefire with Iran, saying he was giving Tehran’s leaders time to produce a unified peace proposal, while making clear the US naval blockade of Iranian ports would not be lifted.

Iran Strait of Hormuz Seizures Shake the Fragile Ceasefire

The two vessels, the MSC Francesca and the Epaminondas, were escorted to Iranian waters after being intercepted by the IRGC Navy, with the Guard claiming one of the ships was linked to Israel without providing supporting evidence. A third vessel was also reportedly targeted and disabled off Iran’s coast. CNBC reported that Brent crude briefly surpassed $100 per barrel following the incidents, with international benchmark prices rising more than 1.8% as markets weighed the impact on a waterway that normally carries roughly 20% of global oil and liquefied natural gas supply.

Advertisement

Trump Extends the Ceasefire But Keeps the Blockade

Trump had previously vowed not to extend the ceasefire beyond its original deadline, but reversed course on April 21, announcing the extension to give Iranian leaders time to produce a unified response to US terms. NPR reported that Trump posted on Truth Social that Iran is “collapsing financially,” losing $500 million a day under the blockade, and that the US loses nothing by maintaining it. Iranian Foreign Minister Seyed Abbas Araghchi has rejected the administration’s framing, calling the blockade “an act of war” and a violation of the ceasefire agreement in its own right. Peace talks scheduled for Islamabad have stalled, with Iran’s negotiating team declining to participate while the blockade continues.

What the Hormuz Crisis Means for Bitcoin and Crypto Markets

The Strait of Hormuz has been a direct driver of Bitcoin volatility since the conflict began in February. As crypto.news has tracked, each escalation event in the strait has triggered immediate Bitcoin selling rather than safe-haven buying, with BTC dropping below $74,000 earlier this week as peace talk prospects faded. Oil prices remaining above $100 per barrel sustains the inflation narrative that has suppressed Federal Reserve rate cut expectations, creating a prolonged headwind for risk assets including crypto. Any resolution that reopens the strait and brings oil back toward pre-war levels near $65 to $70 a barrel would, according to analysts covered by crypto.news, represent the largest positive catalyst for digital asset markets since Bitcoin’s all-time high of $126,000 in October 2025.

The situation in the Strait of Hormuz remains highly fluid, with Iran’s seizure of the two vessels and the breakdown of Islamabad talks raising the risk of further escalation before any diplomatic resolution is reached.

Advertisement

Source link

Continue Reading

Crypto World

Lazarus Group Uses Fake Meeting Hack

Published

on

Lazarus Group Uses Fake Meeting Hack

North Korea’s Lazarus Group has launched a new macOS malware campaign called Mach-O Man that uses fake online meeting invitations to trick crypto and fintech executives into executing malicious commands on their own devices, according to blockchain security firm CertiK.

Summary

  • Lazarus Group’s new Mach-O Man campaign uses fake meeting invites to lure executives into pasting malicious terminal commands on their Macs.
  • The malware auto-deletes after execution, making the breach nearly impossible to detect through standard forensic methods.
  • CertiK links the same Lazarus push to over $500 million stolen from DeFi platforms Drift and KelpDAO in the past two weeks.

North Korea’s Lazarus Group is running a new campaign dubbed Mach-O Man that targets executives at crypto, fintech, and other high-value firms by disguising malware delivery as a routine technical fix during a fake business meeting, according to CertiK senior blockchain security researcher Natalie Newson. The campaign was disclosed on April 22 and represents one of the group’s most operationally sophisticated social engineering methods to date.

Lazarus Group Crypto Hack Hides Behind Routine Business Communications

The attack chain begins with an urgent-looking meeting invitation sent over Telegram, impersonating a Zoom, Microsoft Teams, or Google Meet call. The link leads to a convincing but fake website that tells the victim to paste a single command into their Mac terminal to resolve an apparent connection issue, a technique CertiK identifies as ClickFix. Once executed, the command installs a modular malware kit built from native Mach-O binaries tailored for Apple environments, which profiles the host, establishes persistence, and exfiltrates credentials and browser data through a Telegram-based command-and-control channel. Critically, the toolkit auto-deletes after completing its task, making detection and forensic analysis extremely difficult. “These fake verification steps guide victims through keyboard shortcuts that run a harmful command,” CertiK’s Newson told CoinDesk. “The page looks real, the instructions seem normal, and the victim initiates the action themselves, which is why traditional security controls often miss it.”

Advertisement

Why This Attack Is Harder to Catch Than Standard Phishing

Unlike traditional phishing attacks that rely on urgency cues or suspicious sender addresses, the Mach-O Man campaign is designed to look entirely routine at the moment of delivery. Executives in crypto and fintech routinely receive cold outreach from investors, researchers, and business partners, making the fake meeting invitation format a credible lure in a way that generalized phishing often is not. CertiK’s analysis notes that the Mach-O Man framework is tied to Lazarus’ Famous Chollima unit and distributed through compromised Telegram accounts specifically targeting high-value organizations in the digital asset space. Most victims will not realize they have been compromised until well after the malware has erased itself. “They likely don’t know it yet,” Newson said. “If they do, they probably can’t identify which variant affected them.”

The Scale of the Lazarus Threat to Crypto in 2026

CertiK has linked the Mach-O Man campaign to a broader Lazarus offensive that has siphoned more than $500 million from DeFi platforms Drift and KelpDAO in under two weeks, adding to a cumulative theft total estimated at $6.7 billion since 2017. The United Nations has previously estimated that North Korean hackers have stolen several billion dollars in digital assets to fund the country’s weapons programs. “What makes Lazarus especially dangerous right now is their activity level,” Newson said. “This isn’t random hacking. It’s a state-directed financial operation running at a scale and speed typical of institutions.” CertiK is advising crypto professionals to independently verify all meeting requests through a separate channel before clicking any link or downloading any attachment from an unsolicited invitation.

CertiK has shared indicators of compromise tied to the Mach-O Man campaign with the broader security community to support detection and defense efforts across the industry.

Advertisement

Source link

Continue Reading

Crypto World

Bitcoin, Ether Rally Higher As US Monetary Plan Excites Bulls

Published

on

Bitcoin, Ether Rally Higher As US Monetary Plan Excites Bulls

Key takeaways:

  • US government bailout plans and currency swap lines with the UAE are easing global liquidity fears and lowering credit crisis risks.

  • Record Bitcoin ETF inflows and rising BTC miner profits suggest strong bullish momentum despite the ongoing war in Iran.

The total cryptocurrency market capitalization surged to an 11-week high on Wednesday as Bitcoin (BTC) climbed to $79,000 and Ether (ETH) reached $2,400. The bullish momentum occurred as investors grew more confident that immediate US recession risks were fading, despite sustained high oil prices resulting from the war in Iran.

Traders are now weighing whether Bitcoin and Ether are destined for further gains or if a short-term correction is imminent given that economic recession risks persist.

Nasdaq 100 futures (left) vs. Total crypto market capitalization, USD (right). Source: TradingView

The tech-heavy Nasdaq-100 index reached a record high on Wednesday as traders awaited Tesla (TSLA US) quarterly earnings. Brent crude prices rose 9% over two days after reports indicated Iran targeted two vessels in the Strait of Hormuz. Elevated energy costs increase the likelihood of economic stimulus, providing a temporary buffer for risk assets.

US liquidity plans and Bitcoin ETF inflows may offset recession fears

US President Donald Trump reportedly stated during a CNBC interview that “the federal government should help” Spirit Airlines, a budget carrier that has experienced bankruptcy twice since 2025. The Trump administration previously provided capital to chipmaker Intel (INTC US), utility Southern Company (SO US) and defense contractor L3Harris (LHX US).

Advertisement

Direct US government intervention in private firms and the US Treasury signals that credit lines for allies have eased liquidity concerns. US Treasury Secretary Scott Bessent noted Wednesday that both the US and the United Arab Emirates would benefit from a currency swap line intended to “maintain order in the dollar funding markets.”

US allies are facing pressure to sell US bonds to raise dollars for local defense, imports and liquidity amid the collapse of oil revenue and disruptions in the Strait of Hormuz. Potential currency swaps ease these dollar shortages, preventing a spike in US Treasury yields. The overall impact includes lower borrowing costs and a reduced risk of an immediate credit crisis.

Six consecutive days of inflows into US-listed Bitcoin exchange-traded funds (ETFs), totaling $1.54 billion, have likely boosted sentiment. The successful launch of the Morgan Stanley Bitcoin Trust (MSBT US), which reached $145 million in total net assets in under three weeks, improved Bitcoin’s risk perception despite global socio-economic uncertainty.

US-listed spot Bitcoin ETFs daily net flows, USD. Source: SoSoValue

Related: Bitcoin inflows to Binance fall to 2023 low as BTC bulls set target on $80K

Bitcoin miner profitability eases short-term sell pressure

As Bitcoin price neared $79,000, miner profitability hit its highest level since January, according to Luxor’s Hashprice Index. 

Advertisement
Bitcoin miner daily expected earnings per terahash, USD. Source: HashRateIndex

Miners recently gained attention as firms sold significant Bitcoin holdings to fund investments in data centers and AI infrastructure. Examples include MARA Holdings (MARA US), Riot Platforms (RIOT US), Core Scientific (CORZ US) and Cango (CANG US). While higher profitability does not guarantee reduced selling pressure from miners, the bullish momentum creates an incentive to accumulate. 

Ultimately, a short-term correlation with US stock markets continues to dictate cryptocurrency trends; therefore, the war in Iran and tech earnings remain decisive for trader sentiment.

As the US government signals that stimulus measures will be used to secure liquidity and address credit concerns, Bitcoin and Ether appear primed to sustain their upward momentum.