North Korea-linked hackers have escalated attacks on decentralised finance, siphoning more than $500 million from the Drift and Kelp exploits within just over two weeks.
What initially appeared to be isolated breaches now points to a coordinated and sustained campaign, with attackers increasingly targeting structural weaknesses in crypto infrastructure rather than relying solely on social engineering.
The Kelp exploit in particular highlights a strategic evolution in tactics, suggesting a state-driven effort to exploit systemic vulnerabilities embedded in cross-chain and restaking protocols.
“This is not a series of incidents; it is a cadence,”
Said ENS Labs chief information security officer and general counsel, Alexander Urbelis.
The breach did not involve breaking encryption but instead manipulated trusted data inputs, exposing how systems that verify message origin without validating truth can be exploited at scale.
“The security failure is simple: a signed lie is still a lie,”
Urbelis said, adding that signatures confirm authorship but not accuracy.
Security experts said Kelp’s reliance on a single verifier removed a critical safeguard, allowing attackers to approve fraudulent transactions and trigger cascading losses across interconnected platforms such as lending protocols.