Lazarus steals $500 million in new BTC heist

North Korea–linked Lazarus Group launched a coordinated campaign called “Mach-O Man,” stealing roughly $500 million in crypto from platforms including Drift and KelpDAO, using ClickFix social‑engineering and modular macOS malware to compromise executives and DeFi infrastructure. Security specialists warn the operation is state‑backed, highly reusable, and erases traces, raising systemic risk for crypto firms, DeFi users and custodians. Market impact: heightened security concerns and reputational risk could pressure crypto sentiment and flows, spur tighter operational controls, and accelerate regulatory and institutional scrutiny—potentially dampening near‑term demand for custody and DeFi services even as firms boost defenses.