$290 Million KelpDAO Hack May Be Work of North Korean Group, Reports Say

A massive cryptocurrency theft over the weekend may have been carried out by a North Korean hacking group, according to media reports.

"A Highly Sophisticated State Actor"

North Korean Group TraderTraitor Suspected

TechCrunch and NK News reported on April 21 that more than $290 million in cryptocurrency was stolen on April 18 from KelpDAO, a blockchain-based decentralized finance, or DeFi, platform.

LayerZero, an infrastructure provider for KelpDAO, said in an April 20 statement that there were signs the attack was the work of "a highly sophisticated state actor" and that North Korea's Lazarus Group was the most likely culprit. It specifically pointed to TraderTraitor, a North Korean hacking group, as a suspect.

Lazarus is a hacking organization under North Korea's Reconnaissance General Bureau and is believed to have been established in 2009. The group drew global attention after the 2014 hack of Sony Pictures.

It has also been linked to a string of major cybercrimes. In 2016, it stole $81 million from Bangladesh Bank. In 2017, it spread the WannaCry ransomware attack, causing widespread damage in more than 150 countries.

KelpDAO offers staking services that pay token-based interest to users who deposit cryptocurrency, similar to a bank deposit. NK News reported that the hackers used the stolen crypto assets as collateral to borrow actual funds on DeFi lending platforms. The shock triggered users to pull more than $13 billion in cryptocurrency from multiple platforms.

The KelpDAO breach is estimated to be the biggest cryptocurrency theft so far this year. Earlier in April, another DeFi platform, Drift, suffered a hack worth about $285 million, and that attack also prompted claims of North Korean involvement.

North Korea has increasingly turned to cryptocurrency theft to fund its nuclear and missile programs and support the regime as international sanctions restrict normal trade. Blockchain analytics firm Chainalysis said North Korea stole $2 billion in cryptocurrency last year. Its cumulative haul to date has been estimated at $6.75 billion.

Park Su-bin, Hankyung.com reporter waterbean@hankyung.com