On April 18, 2026, a forged cross-chain message drained $292 million from KelpDAO’s LayerZero bridge in under 46 minutes. Preliminary attribution points to North Korea’s Lazarus Group, which combined with the Drift Protocol exploit has drained more than $575 million from DeFi in under three weeks.