Solana DEX Stabble Warns Users to Exit After North Korean Hacker Allegation

Solana-based decentralized exchange Stabble issued an emergency alert on April 7, 2026 urging liquidity providers to withdraw funds after on-chain investigator ZachXBT identified former CTO Keisuke Watanabe as an alleged North Korean hacker. The platform's total value locked plummeted 62% from $1.75 million to under $663,000, though no actual exploit was disclosed. The incident follows a $285 million hack of Solana's Drift Protocol less than a week earlier and a record $1.4 billion Bybit breach in 2025, both linked to North Korean actors. The Solana Foundation responded by launching new security initiatives on April 6, 2026 to protect DeFi protocols with at least $10 million in total value locked.

Stabble's emergency response to North Korean hacker allegation

• ▪Solana decentralized exchange Stabble urged users to pull liquidity from the platform after learning its former chief technology officer was flagged as an alleged North Korean hacker.
• ▪Stabble was recently taken over by a new team prior to the emergency alert.
• ▪Pseudonymous on-chain sleuth ZachXBT identified Keisuke Watanabe as an alleged North Korean hacker who worked as CTO at Stabble last year.
• ▪Stabble's total value locked dropped 62% from $1.75 million to less than $663,000 following the emergency request to users.
• ▪Stabble posted an emergency alert on X at approximately 9:34 a.m. ET on Tuesday April 7, 2026 asking users to temporarily withdraw liquidity.

North Korea's pattern of cryptocurrency exploits and infiltration

• ▪The Drift Protocol attackers deployed malicious developer tools to execute the $285 million drain.
• ▪Solana DeFi protocol Drift was exploited for more than $285 million by hackers linked to North Korea less than a week before the Stabble alert.
• ▪The Drift Protocol exploit involved a complex, sophisticated scheme played out over six months using fabricated professional identities and in-person conference meetings.
• ▪Hackers from North Korea exploited crypto exchange Bybit for $1.4 billion in 2025, the largest crypto hack of all-time.
• ▪Individuals believed to be from North Korea are trying to get hired at Binance every day, according to Binance's chief security officer.

Solana ecosystem security measures

• ▪The Solana Foundation launched multiple new security efforts for the ecosystem on Monday April 6, 2026.
• ▪The Solana Foundation stated it would help secure DeFi protocols with a total value locked of at least $10 million.

Perspective of Stabble

• ▪Stabble issued an emergency alert to users as a precautionary measure after learning about the alleged North Korean hacker connection.
• ▪Stabble is conducting security audits to verify the platform's integrity following the discovery of the alleged North Korean hacker on its former team.

Perspective of Solana Foundation

• ▪The Solana Foundation will provide security assistance to DeFi protocols on Solana with at least $10 million in total value locked.

Perspective of Cryptocurrency security researchers

• ▪North Korean hackers are using sophisticated tactics including fabricated professional identities and in-person conference attendance to gain access to crypto platforms.
• ▪The Stabble incident represents a continuation of North Korean efforts to infiltrate cryptocurrency companies through employment.

Perspective of Stabble liquidity providers

• ▪Stabble liquidity providers withdrew approximately $1.09 million from the platform following the emergency alert about the alleged North Korean hacker.

2 sources