Lazarus Group Linked to $292M Kelp DAO Hack

$3B in Token Unlocks | World ID Upgrades with Tinder, Zoom, Ticketing

Marco Manoppo & Karon Pangestu
April 20, 2026

📢Sponsor | 💡Telegram | 📰Past Editions

Good Morning,

Prediction markets are becoming a billion-dollar capital race, proof-of-human is going mainstream through Tinder and Zoom, and $3-5B in monthly token emissions is quietly capping every alt rally before it starts.

Check out our latest podcast episode!

In Today's Email:

What Matters: Lazarus Group Linked to $292M Kelp DAO Hack 👀
Product of the Week: World ID Upgrades with Tinder, Zoom, Ticketing
Charts: $3B in Token Unlocks, Polymarket Seeks $400M at $15B Valuation 📊

You read and share. We listen and improve. Send us feedback at marco@launchy.app.

Narratives: Valuation vs Volume

For daily market updates and airdrop alphas, check out our telegram!

TOGETHER WITH

Dexu AI: Get the Signal First

Dexu AI is an AI-powered Web3 analytics platform that quantifies the attention economy across major social media platforms and market metrics.

It helps traders, VCs, founders, and analysts spot emerging trends and narratives early, turning noise into actionable alpha.

—————

Ready to front-run the next big move?

Use our exclusive promo code LAUNCHY at dexu.ai for 20% off Dexu Pro and unlock premium trend intelligence today. Don’t chase hype. Get the signal first.

WHAT MATTERS

Lazarus Group Linked to $292M Kelp DAO Hack

Source: CredShields

State of play: Kelp DAO's LayerZero-powered cross-chain bridge was drained of 116,500 rsETH worth $292M on April 18, with LayerZero attributing the attack to North Korea's Lazarus Group and blaming Kelp's single-DVN setup for enabling the breach.

The attacker poisoned two DVN RPC nodes, launched a DDoS against clean nodes, and exploited Kelp's 1-of-1 DVN setup to push through a fake cross-chain message.
LayerZero explicitly blamed Kelp for ignoring prior recommendations to diversify its DVN setup, and will no longer sign messages from apps running that configuration.
The stolen rsETH was used as Aave V3 collateral to borrow WETH, creating bad debt and triggering over $10B in outflows.
Dozens of protocols including Ethena, ether.fi, and Curve froze their LayerZero OFT bridges, pushing DeFi TVL down 7% in 24 hours to $86.3B.
This marks Kelp's second security incident in 12 months, following an rsETH minting bug in April 2025.

Why it matters: A state-sponsored attack that exploited a single point of failure in cross-chain infrastructure triggered $10B in Aave outflows, exposing how concentrated systemic risk has become across DeFi's bridging layer.

Our take: Kelp ignored LayerZero's own best practice recommendations and ran a 1-of-1 DVN setup on a bridge holding hundreds of millions. That is not a sophisticated attack surface problem. That is negligence, and Aave users paid for it.

For builders and investors: Any protocol running single-DVN configurations should treat this as an immediate remediation priority.

PRODUCT OF THE WEEK

World ID Upgrades with Tinder, Zoom, Ticketing

World rolled out its biggest World ID protocol upgrade yet, expanding its proof-of-human infrastructure to nearly 18M Orb-verified users with new consumer and enterprise integrations across Tinder, Zoom, and a new ticketing tool called Concert Kit.

Tinder is rolling out a global integration giving Orb-verified users a "verified human badge" on their profiles.
Zoom integrated a "Deep Face" protection feature using hardware-backed verification to confirm call participants are real humans and not AI deepfakes.
The upgraded protocol introduces multi-key support, key rotation, recovery mechanisms, and formal session management to meet enterprise security requirements.
World launched a dedicated World ID app as a portable authenticator, letting users manage credentials and control how their identity is used across platforms.
World open-sourced its World ID SDK and introduced a per-monthly-active-user fee model for applications, while keeping the protocol free for end users.

Other cool products:

Polygon launched sPOL.
Morpho unveiled Morpho Midnight.
Ember Protocol has launched eACRED.
Strata launched Midas and M1 Capital’s mM1-USD tracnhes.
World Liberty Fi proposed replacing its original indefinite token lockup.

Take a peek at our referral reward at the bottom of this issue. Share this newsletter and receive our list of 500 crypto VC individuals 👇

CHARTS OF THE WEEK

$3B in Token Unlocks Hit Markets This Month

Source: @WazzCrypto

State of play: April's total value unlock sits at $3.06B, led by Bitcoin ($995M), Others ($862M), Hyperliquid ($360M), Rain ($312M), and Ethereum ($177M), with monthly emissions projected to stay in the $3-5B range indefinitely at current prices.

April's unlock is on the lower end historically, following a $8B+ spike in March driven heavily by Ethereum.
Hyperliquid is the standout altcoin unlock this month at $360M, adding consistent sell pressure on top of its recent regulatory scrutiny.
With $3-5B in monthly emissions baked in across the market, sustained alt upside requires continuous demand absorption just to stay flat.

Our take: The $3-5B monthly emission floor is the quiet killer of alt rallies. Every pump has to fight a structural tide of unlocks, and alt season doesn't start until this overhang thins out.

Polymarket Seeks $400M at $15B Valuation

State of play: Polymarket is in talks to raise $400M at a $15B valuation, potentially growing total committed funding to $1B including ICE's existing $600M stake, as the prediction market race with Kalshi intensifies.

The raise builds on October reports of a $12-15B valuation discussion, up from Polymarket's $9B post-money valuation after ICE's initial investment.
Kalshi raised over $1B at a $22B valuation in March and leads on volume at $13B monthly vs. Polymarket's $10.57B.
Both platforms face mounting regulatory pressure, with US senators introducing the "Prediction Markets Are Gambling Act" last month to bar sports and casino-style prediction contracts.

Our take: Polymarket is chasing Kalshi's valuation while trailing on volume. The $400M raise buys distribution and regulatory runway, but the platform needs a product edge beyond being the crypto-native option to justify a $15B price tag.

QUICK BITES

Bitcoin mining difficulty falls.
Why the bar for crypto VC is higher than ever.
RaveDAO team denies role in RAVE token pump.
Polymarket seeks $400M raise at $15B valuation.
Spot Bitcoin ETFs attract nearly $1B in weekly inflows.
Aave's TVL tanks $8B a day after $293M Kelp DAO hack.
Charles Schwab, Citadel Securities are eying prediction markets.
LayerZero says North Korea's Lazarus likely behind Kelp DAO exploit.
Circle unveils USDC Bridge for native cross-chain stablecoin transfers.
Worldcoin tanks 13% as World’s iris-scanning tech expands to Zoom, Docusign.

NOTEWORTHY READS & MEME

Eli’s read on DeFi Security Illusion.
Silvio’s read on Scenarios in the rsETH crisis.
Jeff Park’s read on What Most People Get Wrong About Prediction Markets.

— (@)

If you enjoy reading this issue, please consider subscribing. It takes 1 minute of your time, but it would mean the world to us 🙇

Disclaimer: All the information presented in this publication and its affiliates is strictly for educational purposes only. It should not be construed or taken as financial, legal, investment, or any other form of advice.