Techin' Geek

This past weekend, hackers pilfered over $290 million in cryptocurrency from Kelp DAO, a platform that enables users to earn yields on dormant crypto investments. 

By Monday, LayerZero, one of the impacted projects, accused North Korea of orchestrating the theft. This incident marks the largest cryptocurrency heist of the year to date, following an earlier breach at the crypto exchange Drift in April that yielded approximately $285 million for the thieves.

In a post on X, LayerZero indicated that the hackers took advantage of Kelp DAO through its LayerZero bridge, which facilitates communication between different blockchains. The attackers exploited Kelp’s security setup, which did not mandate multiple verifications prior to transaction approvals. This deficiency enabled them to extract funds through deceptive transactions.

The firm mentioned “preliminary indicators” suggesting that North Korea is behind the attack, particularly referencing its crypto-targeting hacking group known as TraderTraitor. 

Kelp DAO, in turn, countered LayerZero’s accusations by shifting blame for the theft onto them instead. 

In recent years, hackers linked to Kim Jong Un’s regime have become exceedingly adept at stealing cryptocurrency. Last year alone, North Korean hackers were responsible for the theft of over $2 billion in crypto. Cumulatively, since 2017, the total cryptocurrency pilfered by North Korea is estimated to be around $6 billion.

On Monday, Mastodon’s primary server experienced a distributed denial-of-service attack, according to the social networking software developer, which rendered the instance intermittently unusable.

A significant portion of the website was unreachable, displaying error messages or showing a full-screen outage notification.

The creators of the decentralized social networking platform, which operates the official mastodon.social instance, noted in a status update around 7 a.m. ET on Monday that they were looking into the cyberattack.

By 9:05 a.m. ET, Mastodon announced that it had put in place a “countermeasure against the DDoS attack, and the site is now accessible.” However, the company cautioned that some instability might still be present as the attack remains active.

The cyberattack targeting Mastodon occurred just days after Bluesky, another decentralized social media platform, rectified much of its prolonged service disruptions following a lengthy DDoS assault. According to Bluesky’s update on April 17, the DDoS attack persists, but its service has remained stable since April 16 at 9 PM PDT. Today’s update confirmed this continued stability.

When reached by TechCrunch, representatives for Mastodon did not immediately explain the reason behind the cyberattack.

Distributed denial-of-service (DDoS) attacks operate by directing vast quantities of unwanted web traffic toward the servers of an application or website, aiming to take them offline. While these cyberattacks do not involve data theft, they can significantly disrupt users’ access.

DDoS attacks have escalated considerably in power over recent years. Last year, the network security firm Cloudflare reported it had mitigated what it claims to be the largest DDoS attack to date, peaking at 29.7 terabits per second, equivalent to filling thousands of hard drives with data every minute.

When directed at decentralized social networking platforms, such attacks can lead to instability and outages, though not every user is affected. In Bluesky’s situation, for example, those who had migrated their accounts to other providers, like Blacksky, which operate on the same protocol and can interoperate with Bluesky, were unaffected.

Likewise, the assault on Mastodon has primarily focused on the larger server (mastodon.social) and has not impacted the numerous smaller instances that collectively comprise the whole Mastodon social network.