Lazarus-Linked Attacks Are Reshaping Crypto Threat Modelling
Two incidents, eighteen days, $575 million, one actor. The playbook is corporate intrusion, and most protocol teams are not defended for it.
Roughly $285 million taken from Drift and $290 million from KelpDAO — $575 million from a single threat actor across eighteen days — has done more to change how serious protocol teams think about security than any audit finding this year. Groups tied to North Korea's Lazarus network have been named repeatedly across 2026 incident reports.
An intrusion, not an exploit
The distinction matters operationally. A smart contract exploit is a flaw in deployed code, discoverable by review, fixable by patching, and defended by the audit industry the sector has spent a decade building. An infrastructure attack is a compromise of the people and systems that hold the keys: a targeted approach to an engineer, a malicious dependency, a compromised build pipeline, a session token lifted from a laptop.
The contract behaves correctly throughout. There is nothing for an auditor to find because there is no bug. The transaction that drains the treasury is properly signed by a key that was properly authorised, held by someone who no longer controls it.
Why crypto teams are soft targets
State-linked intrusion sets are practised against banks and defence contractors, which run security operations centres, mandatory device management and staff who have been phished in training. A protocol team is frequently a dozen people, distributed across continents, on personal hardware, hiring through public channels and moving fast by design. The asymmetry is stark, and the payoff for the attacker is an irreversible transfer rather than data that has to be monetised.
What changes in response
The controls that address this are organisational rather than cryptographic: hardware-backed keys with no export path, signers spread across organisations and device types, mandatory timelocks on treasury movements and upgrades, dependency pinning with reproducible builds, and a rehearsed incident response that does not depend on one person being awake.
None of it is novel — it is standard practice in regulated finance. The uncomfortable conclusion of 2026 is that protocols holding hundreds of millions of dollars are now targets of the same calibre of adversary, and rather fewer of them are defended like it.
