North Korea’s crypto heist playbook is expanding and DeFi keeps getting hit

More than $500 million was siphoned across the Drift and Kelp exploits in just over two weeks. What once looked like isolated breaches now resembles a sustained campaign, likely driven by the financial needs of a sanctioned state. What to know : The Kelp exploit shows North Korea’s Lazarus Group is evolving beyond isolated hacks, rapidly shifting tactics from social engineering to exploiting structural weaknesses in crypto infrastructure, suggesting a sustained, state-driven campaign rather than one-off incidents. The attack did not break cryptography but exploited known design choices and weak configurations, exposing how gaps between “decentralization” in theory and real-world implementation continue to create systemic risk across DeFi.