Stabledash Live · Apr 23 · 30 min

Station 70's Adam Healy on Nation-State Attacks and Crypto's Real Security Problem

With Adam Healy

Key takeaways

Adam Healy says the threat actor behind the Drift Protocol attack had millions of dollars to mobilize on the platform, a budget he links to likely nation-state backing.
The $292M Kelp DAO exploit ran through a 1-of-1 verifier setup with LayerZero Labs as the sole DVN, and the two sides dispute who is responsible.
Station 70 is building products such as Bunker on the thesis that security is hard to do well and only 20 to 50 people globally can build a full security program.

Watch the episode

Summary

Healy says recent attacks attributed to North Korea's Lazarus Group show that crypto's weak points sit in infrastructure, people and physical security as much as in code.

Adam Healy, co-founder of Station 70, says the attacker behind the Drift Protocol hack was able to put up millions of dollars to mobilize on the platform, a budget he says you don't usually see among threat actors. He calls the attack a nation-state level intelligence operation that mixed social engineering, cyber attacks and in-person meetings over many months.

From Drift to Kelp

Lazarus Group, the North Korean state-sponsored unit behind the Drift Protocol attack, struck Kelp DAO two weeks later. In the $292M exploit on April 18, 2026, the attackers compromised a LayerZero RPC node, DDoS'd the redundant nodes to force a failover, and used the compromised node to approve a fraudulent cross-chain message that drained the rsETH bridge.

Adam Healy says Kelp DAO ran a 1-of-1 verifier setup with LayerZero Labs as the sole DVN, so one approving node controlled the entire bridge. LayerZero says Kelp ignored multi-verifier recommendations, while Kelp says the defaults made a single verifier the path of least resistance. Healy says he is not a big fan of bridges and urges anyone using one to be very thoughtful about it.

“I can defeat that with a $5 wrench. Yes. And that's becoming even more pronounced.”

Adam Healy

Beyond smart contracts

Adam Healy argues the industry still treats infrastructure-layer attacks as afterthoughts next to smart contract audits. He sorts risk into cyber, integrated technical and physical categories, and says none of the firms he has worked with, including BlockFi, would have been able to prevent what happened at Drift.

He says wrench attacks have exploded in recent months, and that controls such as multisig can increase physical risk. He describes a case where a man's wife and child were held at gunpoint until he moved several million dollars in crypto.

Selling security as product

Adam Healy says there are maybe only 30 people in the world who can design custody securely, and that this scarcity was the thesis behind Station 70. Its flagship Bunker is a disaster recovery and key backup platform that has been in production for about fifteen months with hundreds and hundreds of clients. He points to Prime Trust, which he says lost seventy five million dollars after losing access to wallet keys.

The company has started customer betas for Castle, a take on multifactor auth, and is bringing Gatekeeper, a security engine for AI access policies, to the market in early alpha. Healy says AI tools given a private key in tests try to commit it to GitHub.

Healy's view is that attackers now combine large budgets, patience and physical threats, and that few teams have the talent to respond. His advice is to build ties with the crypto security community before a crisis, not during one, as happened when he was called into BlockFi after its May 2020 data breach.

Signal Foundation, BlockFi, Station 70, and Safe come up most.

Ask AI about this conversation

More from Stabledash Live

Get the lineup before every live show, plus the newsletter’s short reads.