Lazarus group launches massive crypto heist – largest cyberattack of 2026
A relentless North Korean hacking group, Lazarus, has struck again, executing a devastating crypto heist that’s sent shockwaves through the digital currency landscape. This isn’t a repeat; it’s an escalation, surpassing previous breaches in scale and audacity.
A $250 million blow – and counting
The latest attack, targeting a popular online investment platform, resulted in the pilfering of over $250 million in Ethereum (ETH) – specifically, restaked Ether (rsETH) – a figure now poised to become the largest crypto cyberattack of the year. Initial reports indicate vulnerabilities were exploited, leveraging a sophisticated ‘collateral’ money laundering scheme to drain funds from protocols like Aave v3 and Wrapped Ether (WETH).
LayerZero confirmed two of their servers were compromised, allowing Lazarus to build a massive debt within these DeFi ecosystems, effectively turning everyday routers into sophisticated surveillance tools. This highlights a disturbing trend: the weaponization of seemingly innocuous devices for malicious purposes – a chilling reminder of the evolving threat landscape.
The lazarus signature
Experts, including Henri Arslanian of Nine Blocks Capital Management, are unequivocal: this operation bears the unmistakable hallmark of the Lazarus Group. “Clearly, they’re behind it,” he stated. Given their history of orchestrating massive crypto heists – linked directly to the North Korean government and its illicit funding operations – this attack reinforces their established reputation as a highly skilled and persistent cybercrime unit.
The scale of the operation is staggering. In 2025, Lazarus groups were implicated in stealing $14.535 billion in Bitcoin (BTC). And before that, 2024 witnessed over $540 million siphoned from platforms like WazirX and DMM Bitcoin. This latest breach, mirroring those past exploits, underscores the ongoing, and increasingly sophisticated, threat posed by this shadowy organization – a silent, digital predator.
While the company insists there’s no contagion affecting other assets or associated applications, CoinDesk has officially designated this incident as “the largest cyberattack against cryptocurrencies in 2026 to date,” prompting renewed scrutiny of platform security protocols. The group, Kyber, is already experimenting with post-quantum cryptography on Windows, a development that adds another layer of concern.