North Korea's Expanding Crypto Theft Tactics Target DeFi

Less than three weeks after hackers linked to North Korea used social engineering to breach crypto trading firm Drift, another major exploit has been carried out against Kelp, a restaking protocol connected to LayerZero's cross-chain infrastructure. This attack suggests an evolution in tactics, with hackers now exploiting fundamental assumptions in decentralized systems, rather than just seeking bugs or stolen credentials. The combined incidents point to a more organized effort by North Korea to hijack crypto funds. According to Alexander Urbelis, chief information security officer and general counsel at ENS Labs, 'This is not a series of incidents; it is a cadence. You cannot patch your way out of a procurement schedule.' More than $500 million was siphoned across the Drift and Kelp exploits in just over two weeks. The Kelp breach did not involve breaking encryption but rather manipulated data feeding into the system, forcing it to rely on compromised inputs and approve non-existent transactions. 'The security failure is simple: a signed lie is still a lie,' Urbelis said. 'Signatures guarantee authorship; they do not guarantee truth.' The attack exploited how the system was set up, particularly a configuration choice that relied on a single verifier to approve cross-chain messages, which, while faster and simpler, removes a critical safety layer. Experts recommend using multiple independent verifiers to approve transactions, akin to requiring multiple signatures on a bank transfer. The fallout has affected not just Kelp but also other platforms, such as lending platforms like Aave that accepted impacted assets as collateral, turning a single exploit into a wider stress event. The incident highlights a gap between the marketing of decentralization and its actual implementation. 'A single verifier is not decentralized,' said David Schwed, COO of blockchain security firm SVRN. 'It’s a centralized decentralized verifier.' Decentralization is not a property a system has but a series of choices, and the stack is only as strong as its most centralized layer. Attackers are increasingly focusing on less visible layers like data providers or infrastructure, which are critical but complex and tend to hold large amounts of value, making them attractive targets. As Lazarus, a group linked to North Korea, continues to adapt, the biggest risk may not be unknown vulnerabilities but known ones that are not fully addressed. The Kelp exploit did not introduce a new weakness but showed how exposed the ecosystem remains to familiar ones, especially when security is treated as a recommendation rather than a requirement.