DPRK-Linked Hackers Exploit Thorchain for Crypto Laundering

A recent hack on KelpDAO Layer Zero has raised concerns about the security of decentralized finance (DeFi) platforms. The attacker, believed to be affiliated with the DPRK, used Thorchain to launder stolen funds into the Bitcoin network.

According to an analysis by SpecterAnalyst, the attacker deployed over 400 addresses and channeled around 99% of the funds through Thorchain, resulting in a significant spike in daily swap volume. This generated $189,000 in fees, highlighting the potential for substantial financial gain through malicious activities.

The use of Thorchain in this hack has echoes of previous exploits, including the 2025 Bybit hack. The incident underscores the persistent threats posed by state actors like DPRK to cross-chain security. Additionally, it highlights the importance of addressing vulnerabilities in decentralized finance platforms.