Threats Day Bulletin: $290M DeFi Hack, macOS LotL Abuse, Proxy Smart SIM Farms +25 New Stories

Summary: LayerZero reported that North Korean threat actors tracked as TraderTraitor may have been behind the hack of DeFi project KelpDAO, which resulted in the theft of $290 million by compromising a quorum of the RPC nodes its DVN relied upon to verify transactions. The Arbitrum Security Council temporarily froze the 30,766 ETH held in an address on Arbitrum One connected to the exploit, and Chainalysis described the attack as a compromise of off-chain infrastructure against a 1-of-1 DVN setup rather than a smart contract hack.
Why it matters: A $290 million loss came from poisoning the verification layer around a contract, not from breaking the contract itself, and the same actor was attributed to the $1.5 billion Bybit theft in early 2025. If your trust model rests on a single verifier or a handful of nodes, that is the number to weigh against it.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2024-57046 CVE-2025-22952 CVE-2026-27174 CVE-2026-27175
Related: ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More Cyber Risks ·
University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026