North Korean Blamed for $290m KelpDAO Crypto Heist

KelpDAO, a liquid restaking DeFi protocol, was the victim of a sophisticated cross-chain compromise attributed to North Korea’s Lazarus Group: attackers poisoned RPCs used by a LayerZero Decentralized Verifier Network, compromised two RPC nodes (swapping binaries), launched DDoS to force failover to poisoned nodes, and submitted a forged cross-chain message to transfer 116,500 rsETH (~$293M) which was partially funneled through Tornado Cash; Arbitrum’s Security Council has frozen roughly 30,766 ETH (~$71M). LayerZero and KelpDAO dispute blame—LayerZero says KelpDAO used an insecure 1/1 DVN configuration contrary to best practices—while analysts warn the campaign demonstrates advanced, patient supply-chain style tactics and increasing Lazarus operational capability.