When Nation-States Target Your Protocol: Inside Lazarus Group's War on DeFi

The threat most protocols aren’t prepared for

In February 2025, North Korea’s Lazarus Group carried out the largest cryptocurrency heist in history, taking $1.5 billion from Bybit in a single operation. There was no smart contract vulnerability involved and no bug in the code. The attackers compromised the people and systems around the protocol’s multi-signature wallet infrastructure.

It was the high point of a campaign that has run for a decade. According to Chainalysis, North Korean threat actors stole at least $2.02 billion in cryptocurrency in 2025 alone, which accounted for 76% of all service compromises globally. The cumulative total now exceeds $6.75 billion.

Most security audits look at code. Lazarus Group goes after people, processes and the systems that connect them, and so far that has worked for them.

At HYDN we have spent years studying and defending against APT groups including Lazarus, MuddyWater and Kasablanka, and what follows comes from that operational experience. It is what we think every protocol team should understand about the threat in 2026.

Who is Lazarus Group?

Lazarus Group operates under North Korea’s Reconnaissance General Bureau (RGB), the country’s primary intelligence agency. Unlike financially motivated criminal hackers, Lazarus works toward state objectives: circumventing international sanctions, funding weapons programs, and getting into global financial systems that are otherwise closed to the country.

That difference changes how they behave. Criminal hackers want efficiency, so they hit easy targets, take what they can and move on. State-sponsored actors want impact. They are patient and well resourced, and they will spend months, sometimes years, positioning themselves for a single high-value operation.

The Bybit hack was not a smash and grab. It followed extensive reconnaissance, careful social engineering, and the exploitation of trust relationships inside the organization’s security infrastructure.

How Lazarus targets protocols: the attack playbook

Phase 1: Reconnaissance and social engineering

Lazarus starts with your people, and only later with your code.

The “Contagious Interview” campaign

One of Lazarus’s most effective tactics is a fake recruitment operation:

1. Threat actors create convincing LinkedIn profiles posing as recruiters from legitimate crypto companies.
2. They reach out to developers, security engineers and operations staff at target organizations.
3. Candidates are invited to complete “technical assessments” that require running code locally.
4. The assessment contains malware that establishes persistent access to the victim’s machine.

This campaign has targeted hundreds of cryptocurrency professionals globally. Standard antivirus does not detect the malware because it is custom built and continuously updated. Once it is installed, the attackers have everything on that machine: credentials, private keys and internal communications, plus a foothold for moving deeper into the organization’s infrastructure.

Watering hole attacks

Lazarus also compromises websites their targets visit. In the “SyncHole” campaign (2024-2025), they exploited zero-day vulnerabilities in mandatory financial software used in South Korea. Visitors to compromised sites had malware silently installed without any user interaction.

For DeFi protocols, the equivalent targets are developer forums, documentation sites and tooling repositories. If someone on your team visits a compromised site, you may already be compromised without knowing it.

Phase 2: Infrastructure compromise

Once Lazarus has a foothold inside an organization, they move laterally and take their time over it.

Targeting multi-signature infrastructure

The Bybit hack specifically targeted Safe{Wallet}, a widely used multi-signature wallet solution. Lazarus left the cryptography alone and compromised the systems used to initiate and approve transactions.

The lesson is that your smart contracts can be perfectly audited and your Solidity flawless, and your protocol can still be completely vulnerable. The attack surface includes every system that touches your treasury operations: the computers used to sign transactions, the channels used to coordinate approvals, and the procedures that govern fund movements.

Supply chain attacks

Lazarus increasingly targets the dependencies and tools that protocols rely on. A compromised npm package, a malicious VS Code extension or a backdoored development tool can give access to dozens of downstream targets. Compromising one widely used tool can open up hundreds of potential victims.

Phase 3: Execution and extraction

When Lazarus executes, they move fast. The Bybit operation extracted $1.5 billion before the organization fully understood what was happening.

Money laundering infrastructure

The stolen assets follow a structured laundering pathway over approximately 45 days:

• Days 0-5 (immediate layering): funds are dispersed across thousands of wallets and run through DeFi protocols and mixing services.
• Days 6-10 (cross-chain movement): assets move through bridges and exchanges to obscure the trail.
• Days 20-45 (conversion): final conversion to fiat currency through complicit or unwitting exchange accounts.

By the time most organizations have completed incident response, the funds are already converted and largely untraceable.

The shift that should concern every protocol

In 2024-2025, Lazarus shifted their primary focus from DeFi protocols to centralized exchanges. Four of their five most recent major hacks targeted centralized virtual asset service providers (VASPs).

This might look like good news for DeFi. It isn’t.

Centralized exchanges are higher-value, more concentrated targets. But the tactics Lazarus developed against DeFi (social engineering, multi-sig compromise, supply chain attacks) work just as well against protocols. The change in targets reflects where the opportunity is, and says nothing about what they are capable of.

DeFi protocols are also increasingly integrated with centralized services. Your bridge relies on external validators. Your oracle network has centralized components. Your treasury operations involve multisig setups with human signers. A well-resourced nation-state actor can attack any of those integration points.

Defensive measures that actually work

These are the security controls that, in our experience defending against APT groups, make a material difference.

1. Assume compromise and design accordingly

Traditional security asks how to keep attackers out. APT-resistant security asks how to limit the damage once they are in.

In practice:

• Segment access so that no single compromised credential grants access to treasury operations.
• Require out-of-band verification for high-value transactions (phone call confirmation, a separate communication channel).
• Put time delays on large transfers so a human can intervene.
• Maintain cold storage reserves that require physical, in-person access to move.

2. Harden your human attack surface

Your developers, your operations team and your contractors are all targets.

In practice:

• Run security awareness training focused specifically on the social engineering used against crypto teams.
• Set strict policies about running code from external sources, including “technical assessments” from recruiters.
• Use hardware security keys for all authentication, with no SMS and no TOTP apps on phones that may be compromised.
• Review regularly who has access to what, and de-provision aggressively when roles change.

3. Verify your supply chain

Every dependency is a potential attack vector.

In practice:

• Lock dependency versions and review all updates before deployment.
• Use reproducible builds to verify that deployed code matches audited source.
• Audit your development environment: browser extensions, IDE plugins, CLI tools.
• Consider air-gapped machines for signing operations.

4. Implement detection as well as prevention

You can’t prevent every intrusion, so you need to know when you have been compromised.

In practice:

• Monitor for anomalous access patterns in your infrastructure.
• Deploy canary tokens and tripwires that alert on unauthorized access.
• Run regular threat hunting exercises that look for indicators of APT activity.
• Write incident response plans that assume state-sponsored adversaries.

5. Red team your operations as well as your code

A smart contract audit verifies your code. Lazarus attacks the systems and people around it.

In practice:

• Red team exercises that simulate social engineering attacks against your team.
• Operational security assessments that evaluate your transaction signing workflows.
• Third-party reviews of your multi-sig and treasury management procedures.
• Tabletop exercises that walk through APT-style attack scenarios.

Why this matters now

The cryptocurrency industry has historically treated state-sponsored attacks as theoretical or distant. Lazarus Group’s 2024-2025 campaign showed the threat is immediate and material, and that it reaches the largest organizations in the space: $6.75 billion stolen, the largest single theft in history, and 76% of all service compromises attributed to one nation-state actor.

Better smart contract audits alone will not solve this. Protocols have to widen what they mean by security, from code correctness to operational resilience against sophisticated, patient, well-resourced adversaries.

HYDN’s approach

HYDN’s team includes researchers with direct operational experience against APT groups including Lazarus, MuddyWater and Kasablanka.

Alongside auditing your smart contracts, we assess your whole security posture: the systems that support your protocol, the operational procedures that govern high-value transactions, and the human factors that sophisticated attackers exploit.

If you are building infrastructure that will hold significant value, your security has to account for nation-state adversaries too.

To assess your protocol’s resilience against state-sponsored threats, contact HYDN for a security consultation.

Key takeaways

1. Lazarus Group stole $2.02 billion in crypto in 2025, more than half of all cryptocurrency theft globally.
2. They attack people and systems, not code. Social engineering, supply chain compromise and operational security failures are their primary vectors.
3. The Bybit hack ($1.5B) exploited multi-sig infrastructure, not smart contract vulnerabilities.
4. Traditional security audits are necessary but insufficient. Protocols need operational security assessments, red team exercises and APT-aware defensive measures.
5. HYDN brings operational APT experience that most security firms can’t match, because we have been on the front lines against these groups.

HYDN Security provides smart contract audits, penetration testing, and red team services for Web3 protocols and DeFi projects. Our team has protected organizations against threats from Lazarus Group, Kasablanka, MuddyWater, and other advanced persistent threat actors. Learn more at hydnsec.com.