TLDR
North Korea linked Lazarus Group has been tied to a record wave of DeFi hacks totaling around 635 million dollars in April 2026.
- Most of the 635 million dollars came from two DeFi exploits, Drift Protocol and KelpDAO, both widely attributed to Lazarus.
- The attacks relied less on smart contract bugs and more on deep social engineering and infrastructure compromises, revealing systemic DeFi weaknesses.
- The hacks triggered large TVL outflows and spooked institutions, increasing pressure for new security standards and stricter design of bridges and verifiers.
Deep Dive
1. What Happened And Where The 635M Comes From
Reports estimate that DeFi protocols lost about 635 million dollars in April 2026, with blockchain security firms and media attributing most of that to Lazarus Group led exploits on Drift Protocol and KelpDAO.North Koreas Lazarus Group hacks 635M from crypto protocols in April
Drift, a Solana based derivatives platform, lost roughly 280 to 285 million dollars on 1 April after a long running infiltration that let attackers seize administrative control.Lazarus Group May Have Compromised Multiple Top DeFi Protocols
Around 18 April, KelpDAOs rsETH restaking system was drained for about 290 to 292 million dollars through a forged cross chain message that abused LayerZeros verifier setup, pushing total April DeFi losses above 600 million dollars.Lazarus Group hacks KelpDAO, pushes April DeFi losses over 600M
A single state backed actor was responsible for almost all major DeFi losses in that month, turning one off protocol risk into system level risk.
2. Lazarus Tactics And Why They Are Different
Investigations describe Lazarus operatives embedding themselves in DeFi projects for months as developers or trading firms, using conferences, fake job offers, and malware laden tools to gain privileged access.Lazarus Group May Have Compromised Multiple Top DeFi Protocols
In Drifts case, malware disguised as a wallet or dev tool compromised staff devices and shared repos, while KelpDAO was hit at the infrastructure layer via compromised RPC nodes and a single verifier configuration, not via a core contract bug.KelpDAO suffered a 290M exploit on its rsETH configuration
Parallel campaigns like the Mach O Man macOS malware show Lazarus targeting corporate Macs via fake video calls, then stealing credentials and keys at scale.Lazarus Group macOS malware Mach O Man
Traditional audits and on chain checks are not enough if attackers already control infrastructure or insiders.
3. Market Impact And What To Watch Next
The KelpDAO hack alone triggered an estimated 13 to 15 billion dollars in DeFi TVL outflows and created bad debt on lending platforms like Aave, while Arbitrums security council froze roughly 70 million dollars of related funds.Lazarus Group linked to 292M DeFi hack, 13B TVL outflows ensue
Banks and research desks now cite Lazarus style exploits as a key reason institutions are cautious about putting serious size into open DeFi, especially on cross chain bridges and restaking protocols.Big banks reevaluate blockchain after 293M DeFi hack
Curves founder and others are pushing for industry standards such as multi verifier bridge designs, reduced single points of failure, stronger contributor vetting, and zero trust operational security across DeFi infrastructure.Curves Michael Egorov calls for new DeFi standards
For DeFi users, the critical variables are not just yields, but bridge architecture, validator diversity, and how seriously teams treat insider and infrastructure risk.
Conclusion
Lazarus driving roughly 635 million dollars of DeFi hacks in a single month shows that sophisticated, state backed attackers can turn niche design flaws into sector wide stress. Until bridges, verifier networks, and governance processes are hardened, DeFi security risk stays structurally high, and both individual users and institutions will need to weigh protocol design and operational security as heavily as returns.
CoinsKid.Com