KelpDAO rsETH $292M Bridge Exploit (Explained)

Lazarus Group’s TraderTraitor cluster is preliminarily linked to a $292M KelpDAO rsETH bridge exploit that abused a 1-of-1 LayerZero DVN setup rather than a smart contract flaw. The attacker allegedly poisoned RPC infrastructure used by LayerZero’s DVN, f…

js-logger-pack Operator Turns Hugging Face into a Malware CDN and Exfiltration Backend

Malicious `js-logger-pack` versions used an npm `postinstall` script to download cross-platform `MicrosoftSystem64` Node SEA implants from Hugging Face, giving the operator persistent access on Windows, macOS, and Linux. The implant connects to `195.201.1…

Where did the kelp $292m go? anatomy of a $292m laundering

The excerpt traces laundering after a reported North Korean theft of $292 million from Kelp DAO, describing pre-funded Tornado Cash wallets, cross-chain gas preparation, and a forged LayerZero message that released 116,500 rsETH. The actor rapidly convert…

I got completely owned by the most sophisticated hack I've ever encountered

A developer describes a highly polished fake recruiting process that used a realistic company website, apparent HR and engineering interviews, and a coding challenge to persuade the victim to run a supplied repository. The visible repo appeared clean, but…

North Korean Lazarus Group has weaponized this exact class of Microsoft-signed kernel driver

The archived driver analysis alleges that North Korea’s Lazarus Group has weaponized the same class of Microsoft-signed OEM kernel driver weakness discussed in the post. The cited Dell WDTKernel.sys driver exposes 47 privileged commands without access con…

Inside the KelpDAO Bridge Exploit

Attackers linked by LayerZero to DPRK Lazarus Group's TraderTraitor stole about $292 million in rsETH from KelpDAO's LayerZero bridge on April 18, 2026. The operation targeted off-chain verification infrastructure, compromising LayerZero-hosted RPC nodes …

Inside Lazarus: How North Korea uses AI to industrialize attacks on developers

Expel tracks HexagonalRodent as a high-confidence DPRK state-sponsored cluster focused on stealing cryptocurrency and NFTs from Web3 developers. The group uses fake job offers and coding assessments that are backdoored through VSCode tasks.json run-on-fol…

Unmasking DPRK Cyber Threat Actors: Fake IT Worker Infrastructure

Team Cymru examines infrastructure tied to DPRK-linked fake IT worker activity after ZachXBT connected luckyguys[.]site to related cryptocurrency payments. The domain resolved to 163.245.219[.]19, where network telemetry showed concentrated Astrill, Mullv…

North Korea Stole $7.5 Billion From Crypto. Here's Their Playbook.

QuillAudits frames Lazarus Group's cryptocurrency theft as an industrialized DPRK state capability, estimating more than $7.5 billion stolen through social engineering, insider-style access, UI poisoning, laundering infrastructure, and off-chain verificat…

KelpDAO Hacker Moving Funds: Attacker Transfers $175M to New Addresses

Arkham tracked the suspected Lazarus Group-linked KelpDAO attacker moving 76,000 ETH, worth about $175 million, from the $292 million theft into new on-chain addresses. The movement followed containment on Arbitrum, where about $71 million in stolen ETH l…

A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail

Breakglass Intelligence attributes 158.247.210.58, a Vultr Seoul VPS, to the same Kimsuky-aligned infrastructure cluster as two previously documented Vultr Seoul systems. Passive DNS showed more than 60 domains over an 18-month window, with 31 still resol…

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Trend Micro found Void Dokkaebi, also tracked as Famous Chollima, turning fake recruiter interviews into a worm-like supply chain campaign against software developers. Victims are lured into cloning repositories that abuse VS Code folder-open tasks, and c…

Detection strategies across cloud and identities against infiltrating IT workers

Microsoft describes how Jasper Sleet, a North Korea-aligned fraudulent IT worker operation, exploits remote hiring workflows to gain trusted organizational access. The actors use stolen or fabricated identities, AI-assisted personas, and role-specific app…

New Lazarus APT Campaign: “Mach-O Man” macOS Malware Kit Hits Businesses

ANY.RUN attributes an active ClickFix-style macOS campaign to Lazarus Group, with fake meeting lures delivered through Telegram and impersonated Zoom, Teams, or Google Meet pages. Victims are instructed to run terminal commands that install the Go-based M…

SlowMist on Kelp DAO × LayerZero Systemic Risk

SlowMist frames the Kelp DAO rsETH and LayerZero incident as a cascading DeFi failure involving liquid restaking tokens, cross-chain bridge verification, and lending-protocol collateral assumptions. The interview says LayerZero attributed the attack to La…