Imagine logging in to check your investments, only to find a staggering $290 million has vanished into thin air. That's the nightmare scenario facing users of Kelp DAO this week, after a brazen digital heist. But the real shock isn't just the amount stolen—it's who intelligence experts are pointing the finger at.
By Monday, the blockchain project LayerZero made a stunning accusation: this was the work of North Korea. The regime's notorious hacking squad, known as TraderTraitor, is suspected of exploiting a critical weakness to pull off the largest crypto theft of 2026 so far. This isn't just a hack; it's a state-sponsored raid on the digital economy.
The Fatal Flaw That Unlocked a Fortune
So how did they do it? The hackers didn't need to crack an unbreakable code. Instead, they exploited Kelp DAO's own security setup via a "bridge" service provided by LayerZero, which connects different blockchains. The system had a devastating flaw: it did not require multiple verifications before approving transactions.
This single oversight was all the opening the hackers needed. They created fraudulent instructions, and the system obediently handed over the funds. In a public post, LayerZero stated it had "preliminary indicators" firmly pointing to North Korean operatives, famous for funding their regime through crypto crime.
Why This Heist Should Terrify Every Crypto Investor
This isn't a one-off event. It's part of a terrifying pattern. Last year alone, North Korean hackers stole over $2 billion in cryptocurrency. Since 2017, their total haul is estimated at a mind-boggling $6 billion.
These aren't random cyber-criminals; they are state agents with immense resources, using stolen funds to bankroll weapons programs and bypass international sanctions. Every successful heist makes their regime stronger and more dangerous.
The Blame Game and the Broken System
In the aftermath, a public feud has erupted. LayerZero blames Kelp DAO's security configuration for the breach. Kelp DAO, in turn, has pointed the finger back at LayerZero. This confusion leaves ordinary users caught in the middle, wondering who is truly responsible for safeguarding their assets.
The incident exposes a harsh truth in the decentralised world: when things go wrong, the lines of accountability can vanish as quickly as the money did.
For anyone with money in the crypto space, this heist is a deafening wake-up call. It proves that the most sophisticated threats aren't just hunting for loose change—they are systematically targeting the core infrastructure of finance itself. The tools for protection exist, but as this week shows, they are worthless if not properly used. The question now is: which protocol will be next?